socks5systemz | 34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce

Analysis

max time kernel
142s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 10:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.exe
Size 3.7MB
Sample240811-mjpsjszdmg
SHA256 34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce
MD5 4d3dcc0efebaa29fc6dfa41fda013c6f
SHA1 d43de39edcf393773370ae718ebde60c022ee495
SHA512 3460b71f1054fe0cb0f4d3542f8a93f5b1c21f92038e823d2af180a604c8c023d4c677e1ea9791cf79bb12fac2c2c771b862c0f87f3cb5107e38d11ccf100bce
SSDEEP 98304:NgUDGJ0yC1egV9WtnhbF3GkJ82COiATeSaFPyb9ILDurdw:7u4odF3Gf2DiGecb9I+rG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1044-77-0x00000000026D0000-0x0000000002772000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp
3688	xulplayer.exe
1044	xulplayer.exe

Loads dropped DLL 1 IoCs

pid	Process
4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xulplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xulplayer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp
4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 4444	4008	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.exe	86
PID 4008 wrote to memory of 4444	4008	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.exe	86
PID 4008 wrote to memory of 4444	4008	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.exe	86
PID 4444 wrote to memory of 3688	4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp	90
PID 4444 wrote to memory of 3688	4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp	90
PID 4444 wrote to memory of 3688	4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp	90
PID 4444 wrote to memory of 1044	4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp	91
PID 4444 wrote to memory of 1044	4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp	91
PID 4444 wrote to memory of 1044	4444	34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp	91

C:\Users\Admin\AppData\Local\Temp\34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.exe
"C:\Users\Admin\AppData\Local\Temp\34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Users\Admin\AppData\Local\Temp\is-VR1OK.tmp\34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VR1OK.tmp\34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp" /SL5="$6029E,3564417,54272,C:\Users\Admin\AppData\Local\Temp\34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Users\Admin\AppData\Local\XULPlayer\xulplayer.exe
    "C:\Users\Admin\AppData\Local\XULPlayer\xulplayer.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3688
- - C:\Users\Admin\AppData\Local\XULPlayer\xulplayer.exe
    "C:\Users\Admin\AppData\Local\XULPlayer\xulplayer.exe" -s
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-CHU3R.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-VR1OK.tmp\34aafc02c00121fa34646aeb5abdd1c253ed74817d82a53c6b38f643b52081ce.tmp
Size 692KB
SHA256 8d33851dabd3a3d8701eb8d48b7da5d6bdc73d178ae9d567c35e87e0a1060926
MD5 e27c73e7da7324243f44020bdb626e16
SHA1 3efcc9a1d7e3951b249021b9adda9bced6a703c2
SHA512 3bdd8971bfc950ca5fc8b6475f0e18a79cce186b4b39843560590fd24873a9725c1c4f50df8d81aa9f74dc6d351188594e2426a9fe3f6bf6c0d2bb8e9b3b7216
SSDEEP 12288:thu7eEcdCP8trP837szHUA6JCzS9Ntc3l3ER6orNjUR/FDExyF:Pu7eEYCP8trP837szHUA60SLtcV3E9yT
MD5 SHA1 SHA512 SSDEEP

Submit Download

xulplayer.exe

Path C:\Users\Admin\AppData\Local\XULPlayer\xulplayer.exe
Size 3.9MB
SHA256 70da0077e3906752c3f3463e1fa3a1a0fd72d413e4a073190fb95a90a808837a
MD5 8643c69ca4f55fdc06857ccd3208262d
SHA1 5161dd8f4b28ab63de6f957462b00c25417929d2
SHA512 ae2eb941e7e43d020e43ee79c12585f3c03a2dfcf6ec0ee8a6417ca00f87dabfef03e9a0d838bf6e7c10fbb09a4948c3043defe01fbaed76e7de09074c43d92d
SSDEEP 49152:K26i8S26iIyr26iw26ila26ie526iM26icP26i4mS1bau0AVaWlVxsIaeobjG0pT:uo8meau0hC/HaeobjG0pV9wDz7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-79-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-68-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-106-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-103-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-99-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-96-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-59-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-93-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-90-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-62-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-65-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-87-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-71-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-74-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/1044-77-0x00000000026D0000-0x0000000002772000-memory.dmp

Download

memory/1044-84-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/3688-55-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/3688-53-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/3688-52-0x0000000000400000-0x00000000007E0000-memory.dmp

Download

memory/4008-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4008-60-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4008-2-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/4444-13-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/4444-61-0x0000000000400000-0x00000000004BD000-memory.dmp

Download