socks5systemz | d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c

General

Target

d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe
Size

4.5MB
MD5

309f1a7dd94f69097297bf997578ee96
SHA1

3e031317d5e5408e3f9bebc55edf56e76af5b386
SHA256

d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c
SHA512

4219a80f3db0d30bc63c8f23e77d97b931a2303b11068a58ef1ea90ac9b07cd1f5b0ab14200a74b8678b0b0b99ff368c3dd277728a50b3422619d8a6425f5c8e
SSDEEP

98304:IU5dKRQjk0ZWvBpVR0k3v5l4oBQwvmOBLLEsEJl7OA8ijuhmgDjKu4Rxz:/5kRQjpWvz9fVruOpEsEJl7JNjM6dRV

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3672-101-0x00000000008D0000-0x0000000000972000-memory.dmp	family_socks5systemz
behavioral2/memory/3672-126-0x00000000008D0000-0x0000000000972000-memory.dmp	family_socks5systemz
behavioral2/memory/3672-127-0x00000000008D0000-0x0000000000972000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz

Executes dropped EXE 2 IoCs

pid	Process
2872	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp
3672	ascreenrecorder32.exe

Loads dropped DLL 1 IoCs

pid	Process
2872	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ascreenrecorder32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp
2872	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2872	2164	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe	86
PID 2164 wrote to memory of 2872	2164	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe	86
PID 2164 wrote to memory of 2872	2164	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe	86
PID 2872 wrote to memory of 3672	2872	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp	88
PID 2872 wrote to memory of 3672	2872	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp	88
PID 2872 wrote to memory of 3672	2872	d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp	88

C:\Users\Admin\AppData\Local\Temp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe
"C:\Users\Admin\AppData\Local\Temp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\is-U9V9U.tmp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-U9V9U.tmp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp" /SL5="$C0058,4443113,54272,C:\Users\Admin\AppData\Local\Temp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\AScreenRecorder\ascreenrecorder32.exe
    "C:\Users\Admin\AppData\Local\AScreenRecorder\ascreenrecorder32.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\AScreenRecorder\ascreenrecorder32.exe

Filesize
2.9MB

MD5
551a95d6d8458a580dc0b5a8cd3e3b45

SHA1
84731b5f59f835eb993e38931d0dcac0890df5d5

SHA256
40fc3cd56fbf9312138bdaab4212fde480662b780bf6956493b0e648b35f0bab

SHA512
db770627e5462469341136268cecde5c6d94de9c61cb320f86f7ab70ea5a185c73d1be698af171f585c878dc121e57677b66c22a828b30522af6b0ec636b5938

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A4VKU.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U9V9U.tmp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp

Filesize
689KB

MD5
deb81fa5ce36730b9984e68d0631bbe9

SHA1
4fdaf40d4ac800071355308305222799a9109f86

SHA256
5622e1aed3d14c495ea8622acbecda69355e681282f47f8c3cf4be34c5ce9e26

SHA512
f3e9d22d97668a6053d33be1774a6f3f8a35b8e17f872289fca90d4b271d2e5f59a1986e441ec2ab81c4f1d3eddae3255d13b9d6264281c97891856518d21c64

Download Submit
memory/2164-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2164-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2164-82-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2872-81-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2872-7-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3672-91-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-108-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-77-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-85-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-84-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-88-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-76-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-94-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-97-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-101-0x00000000008D0000-0x0000000000972000-memory.dmp

Filesize
648KB

Download
memory/3672-102-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-80-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-109-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-112-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-113-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-116-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-119-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-122-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-125-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-126-0x00000000008D0000-0x0000000000972000-memory.dmp

Filesize
648KB

Download
memory/3672-127-0x00000000008D0000-0x0000000000972000-memory.dmp

Filesize
648KB

Download
memory/3672-131-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/3672-134-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing