socks5systemz | 02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315

General

Target

02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.exe
Size

5.8MB
MD5

39073a031be4450a886c131c39bcc571
SHA1

6810ee41aea24f1756a5cfccaeb7f13640f52518
SHA256

02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315
SHA512

00c3ef02a01ef2ddf116283479b1cf29cbfa06320a34cb941f8cf2d8b2fd59dd0e3e065d51efa091106ec61248080ccc63b5aabdea4869bc142b3d6bcc265d0e
SSDEEP

98304:4gRUba3qHmKuVaZeeqQng0oaCJR06klMdIOeDWMnX5Q1PIQMniDjA5tIJ6/p3v:VEdHmKuVseeXVoaCJqLllOts5GPIQMia

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/5100-104-0x0000000000A10000-0x0000000000AB2000-memory.dmp	family_socks5systemz
behavioral2/memory/5100-127-0x0000000000A10000-0x0000000000AB2000-memory.dmp	family_socks5systemz
behavioral2/memory/5100-128-0x0000000000A10000-0x0000000000AB2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz

Executes dropped EXE 2 IoCs

pid	Process
1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp
5100	cutmovie32_64.exe

Loads dropped DLL 1 IoCs

pid	Process
1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cutmovie32_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp
1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1292	1892	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.exe	83
PID 1892 wrote to memory of 1292	1892	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.exe	83
PID 1892 wrote to memory of 1292	1892	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.exe	83
PID 1292 wrote to memory of 1312	1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp	87
PID 1292 wrote to memory of 1312	1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp	87
PID 1292 wrote to memory of 1312	1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp	87
PID 1292 wrote to memory of 5100	1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp	89
PID 1292 wrote to memory of 5100	1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp	89
PID 1292 wrote to memory of 5100	1292	02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp	89
PID 1312 wrote to memory of 3360	1312	net.exe	90
PID 1312 wrote to memory of 3360	1312	net.exe	90
PID 1312 wrote to memory of 3360	1312	net.exe	90

C:\Users\Admin\AppData\Local\Temp\02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.exe
"C:\Users\Admin\AppData\Local\Temp\02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\is-RJRD2.tmp\02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RJRD2.tmp\02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp" /SL5="$50280,5837168,56832,C:\Users\Admin\AppData\Local\Temp\02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" pause cut_movie_1174
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 pause cut_movie_1174
      4⤵
      System Location Discovery: System Language Discovery
      PID:3360
- - C:\Users\Admin\AppData\Local\Cut Movie 19.3.35\cutmovie32_64.exe
    "C:\Users\Admin\AppData\Local\Cut Movie 19.3.35\cutmovie32_64.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Cut Movie 19.3.35\cutmovie32_64.exe

Filesize
3.5MB

MD5
aeb4ba1d8b176be75daafec447e10099

SHA1
f35f79a15fe1a9869323b4de32fe2e27436c781b

SHA256
05513a05e32f3659328ac1db95d08a8b4704977c78320d3ae2626d7b6d49392d

SHA512
fcc68415143c480ed6b6f3e456b424c39e5cc987e75b8f21fa4b5213537b0e1dd8f93c80b216007c0e6ab60b9a493b4d86159592d83640a75ec4ba1c44aa639f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NGVS3.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RJRD2.tmp\02a578e13d40730e3e07fdf467a6fd4187268a7124a1900428308832d5b74315.tmp

Filesize
692KB

MD5
ea9cc89129286ad8465669d9ee596e3b

SHA1
048e58c68842cbdefb5169cc36bb18b1b3eed969

SHA256
eae04c8b214713fa402bbc4c5997cc17ff1e53fb6af3d6b7647fab3b1cd722bb

SHA512
ddcf8e9d6694abf5e60d97b12f04d5e28239d625f285329178304c1f8b6f4d4be6769f44beceb78d901ba5af3e0a41c3603d4e771bae4d10177cc1a96620f5d8

Download Submit
memory/1292-84-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1292-6-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1892-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1892-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1892-85-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5100-94-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-110-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-83-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-87-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-88-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-91-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-79-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-97-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-100-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-103-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-104-0x0000000000A10000-0x0000000000AB2000-memory.dmp

Filesize
648KB

Download
memory/5100-81-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-113-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-114-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-117-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-120-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-123-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-126-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-127-0x0000000000A10000-0x0000000000AB2000-memory.dmp

Filesize
648KB

Download
memory/5100-128-0x0000000000A10000-0x0000000000AB2000-memory.dmp

Filesize
648KB

Download
memory/5100-132-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/5100-135-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download

Analysis

Sharing