socks5systemz | 402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4

General

Target

402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.exe
Size

3.4MB
MD5

23a259f3e9a07ef834bcc075d5156299
SHA1

5bfd03fb1cb00cec265cdc5c766bde83a1351ccb
SHA256

402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4
SHA512

1d982c4e0c18e70f32cc8e71bb1d697c598343264e0ebb71b63b3d2bf685430bf8d8f20b2f21ef5d5be31f3b0599255f52de8c3051811a45f502a38bd5f696de
SSDEEP

98304:N+qc7EiZB6+15H+S+K/OUYY7JEmgB1nYP9g/8zJdJ+:sqc7f5eSbOUfdEmgBlYO/8zJm

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2628-78-0x0000000002570000-0x0000000002612000-memory.dmp	family_socks5systemz
behavioral2/memory/2628-103-0x0000000002570000-0x0000000002612000-memory.dmp	family_socks5systemz
behavioral2/memory/2628-104-0x0000000002570000-0x0000000002612000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp
3560	basicbilliardsplayer32.exe
2628	basicbilliardsplayer32.exe

Loads dropped DLL 1 IoCs

pid	Process
1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	basicbilliardsplayer32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	basicbilliardsplayer32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp
1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 1744	4760	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.exe	78
PID 4760 wrote to memory of 1744	4760	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.exe	78
PID 4760 wrote to memory of 1744	4760	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.exe	78
PID 1744 wrote to memory of 3560	1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp	79
PID 1744 wrote to memory of 3560	1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp	79
PID 1744 wrote to memory of 3560	1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp	79
PID 1744 wrote to memory of 2628	1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp	80
PID 1744 wrote to memory of 2628	1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp	80
PID 1744 wrote to memory of 2628	1744	402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp	80

C:\Users\Admin\AppData\Local\Temp\402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.exe
"C:\Users\Admin\AppData\Local\Temp\402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\is-26S01.tmp\402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-26S01.tmp\402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp" /SL5="$6013C,3346773,54272,C:\Users\Admin\AppData\Local\Temp\402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Basic Billiards Player\basicbilliardsplayer32.exe
    "C:\Users\Admin\AppData\Local\Basic Billiards Player\basicbilliardsplayer32.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3560
- - C:\Users\Admin\AppData\Local\Basic Billiards Player\basicbilliardsplayer32.exe
    "C:\Users\Admin\AppData\Local\Basic Billiards Player\basicbilliardsplayer32.exe" -s
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Basic Billiards Player\basicbilliardsplayer32.exe

Filesize
2.9MB

MD5
7f8d6a47e71457fdb5958d1dae3c2832

SHA1
b6d8466377044b3b73764db84c881f423561d390

SHA256
1f73163d93ddbaea6225d024e83150c2978003e47799f2d3bc908d3ea346f6dd

SHA512
cbab5ba1c4672ebf4e2d3b0992c63b1c938eab3d85cbcec11ac4f3865746b06076f6dc871cb15164b1c38fab557416472fb783d5a9997e8293d245fe8daa7e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-26S01.tmp\402f3b90b700568d772c92fd67727457f1743310b1d7541923fe16dc41a59da4.tmp

Filesize
692KB

MD5
74151ec4d7292d18e2bce99ef425d364

SHA1
8f38d39dce20cd6d4a6864f8a4f1afc92924fad7

SHA256
7e4e7fa8339af01bbf3d812959487d47e299bde57e38686aabfca9e586e7010f

SHA512
570a23c1bf70e854e5b2a50f637935ef16a545386aea40474e74774f2e77413fb555c08e2335825a3360e1c98d381924d8c3b20ee6892bc27535993e66b6d871

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VNG7E.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/1744-62-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1744-12-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2628-93-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-67-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-103-0x0000000002570000-0x0000000002612000-memory.dmp

Filesize
648KB

Download
memory/2628-102-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-99-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-60-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-59-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-96-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-111-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-63-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-66-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-104-0x0000000002570000-0x0000000002612000-memory.dmp

Filesize
648KB

Download
memory/2628-70-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-73-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-76-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-78-0x0000000002570000-0x0000000002612000-memory.dmp

Filesize
648KB

Download
memory/2628-81-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-87-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-90-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/2628-108-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/3560-52-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/3560-56-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/3560-55-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/3560-53-0x0000000000400000-0x00000000006DD000-memory.dmp

Filesize
2.9MB

Download
memory/4760-61-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4760-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4760-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing