socks5systemz | 21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4

Analysis

max time kernel
149s
max time network
136s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
04/08/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe
Size 4.2MB
Sample240804-2ng1tsydrr
SHA256 21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4
MD5 f4b5f00a6405855e9dcb207bc46ebabf
SHA1 bc5833f2878c62eb07e19017d3f18382bc3494f9
SHA512 5e23ae6202aff167571f96450d96defab75d3fec8740b1ac8b34f5c5594d1e53abfd7f12df2765d93c31395cf4488d2b66e7483cdd8b48b9d2d0bad95327ec86
SSDEEP 98304:Ns0NIZPUaOg7OiaRudx+yDM6TIZeYx2Fhu3nj4oHjuNiBNI9Vq/dZ:q0NIZsOOi+LyAUIYJY3puYBNQq/T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2864-87-0x0000000002260000-0x0000000002302000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp
2636	combinerfree32_64.exe
2864	combinerfree32_64.exe

Loads dropped DLL 6 IoCs

pid	Process
1856	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe
2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp
2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp
2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp
2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp
2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	combinerfree32_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	combinerfree32_64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp
2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2716	1856	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe	30
PID 1856 wrote to memory of 2716	1856	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe	30
PID 1856 wrote to memory of 2716	1856	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe	30
PID 1856 wrote to memory of 2716	1856	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe	30
PID 1856 wrote to memory of 2716	1856	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe	30
PID 1856 wrote to memory of 2716	1856	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe	30
PID 1856 wrote to memory of 2716	1856	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe	30
PID 2716 wrote to memory of 2636	2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp	31
PID 2716 wrote to memory of 2636	2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp	31
PID 2716 wrote to memory of 2636	2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp	31
PID 2716 wrote to memory of 2636	2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp	31
PID 2716 wrote to memory of 2864	2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp	32
PID 2716 wrote to memory of 2864	2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp	32
PID 2716 wrote to memory of 2864	2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp	32
PID 2716 wrote to memory of 2864	2716	21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp	32

C:\Users\Admin\AppData\Local\Temp\21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe
"C:\Users\Admin\AppData\Local\Temp\21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\is-G86C9.tmp\21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-G86C9.tmp\21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp" /SL5="$5001C,4175874,54272,C:\Users\Admin\AppData\Local\Temp\21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Combiner Free\combinerfree32_64.exe
    "C:\Users\Admin\AppData\Local\Combiner Free\combinerfree32_64.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2636
- - C:\Users\Admin\AppData\Local\Combiner Free\combinerfree32_64.exe
    "C:\Users\Admin\AppData\Local\Combiner Free\combinerfree32_64.exe" -s
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

combinerfree32_64.exe

Path \Users\Admin\AppData\Local\Combiner Free\combinerfree32_64.exe
Size 3.0MB
SHA256 aba83da14d7110bb2a9b1eb8421486cf15a86e27140d46064950a41ff1a139b5
MD5 96d20147eca59b1a80dfa2e68e152ca1
SHA1 968c8455b472f733f938d1c85293d80dec5da0ac
SHA512 2dbccf5af7eb25a08d38651a9ef7a6e208bec7457811c491826fa6e452b2652c5d30f445e31d48350f360385b84303e6960aa98e3f0abece2a7d7ab67fc4211c
SSDEEP 49152:l+0YPWmb9iw4X2v2S8ESwonniSkz3B8jvl2/3Cx5FfHYgIf7mKR4mtthUY:8WudHv2S8ESwoniSkz3B8jvl2/3sFfHa
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path \Users\Admin\AppData\Local\Temp\is-BSQB7.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

_isdecmp.dll

Path \Users\Admin\AppData\Local\Temp\is-BSQB7.tmp\_isetup\_isdecmp.dll
Size 13KB
SHA256 e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
MD5 a813d18268affd4763dde940246dc7e5
SHA1 c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA512 b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
SSDEEP 384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5 SHA1 SHA512 SSDEEP

Submit Download

_shfoldr.dll

Path \Users\Admin\AppData\Local\Temp\is-BSQB7.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp

Path \Users\Admin\AppData\Local\Temp\is-G86C9.tmp\21eef1b1329c0c3f3ead40d8473b15d266353bdc3a97bb836ca0902bcd9af3a4.tmp
Size 692KB
SHA256 02bb867f29452f4451e5e912f4b76028764ed9c0f33e86e84d8fefb30745505d
MD5 7961349e8e405388958eef4b7b824231
SHA1 c3efd3f21c8111949cdf89fe8f3540ffb79ff7d7
SHA512 8229c8c17861254ca1708e7ee7b4f209acb4d0f879bcbff6f0fae2efa068f6a930f0aae9bd465719b6575873cb33e63a2f2fff865fe23b1a962f8df1c2446e07
SSDEEP 12288:thu7eEcdCP8trP837szHUA6JCzS9Ntc3l3ER6orNjURrFDExyF:Pu7eEYCP8trP837szHUA60SLtcV3E9iT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1856-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1856-2-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/1856-68-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2636-64-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2636-60-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2636-61-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2716-69-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/2716-76-0x00000000047F0000-0x0000000004AF1000-memory.dmp

Download

memory/2716-59-0x00000000047F0000-0x0000000004AF1000-memory.dmp

Download

memory/2716-15-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/2864-85-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-87-0x0000000002260000-0x0000000002302000-memory.dmp

Download

memory/2864-72-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-77-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-82-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-66-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-86-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-75-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-93-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-98-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-101-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-102-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-105-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-110-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-114-0x0000000000400000-0x0000000000701000-memory.dmp

Download

memory/2864-115-0x0000000000400000-0x0000000000701000-memory.dmp

Download