socks5systemz | eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371

General

Target

eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.exe
Size

4.6MB
MD5

0e5fcf8057574190c439bb2c61681b30
SHA1

cdaedca940a32071b059976f13ad52fd1dcfa2c1
SHA256

eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371
SHA512

09d9ff569ae54054b679ba5b42ca315ae1308f2d9e193b5687d9653654c7bc4f8f6e2977fdb4bf28381ed49a084d9a93f21710e2b8803c8bb2545f5cbfd78607
SSDEEP

98304:46ztVOA01pzNh+ipiJ/4c50qayBAW4NlE2rJ7VlIs885:drOpLpi1FRnKlE6JJS8

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3992-92-0x0000000000870000-0x0000000000912000-memory.dmp	family_socks5systemz
behavioral2/memory/3992-117-0x0000000000870000-0x0000000000912000-memory.dmp	family_socks5systemz
behavioral2/memory/3992-116-0x0000000000870000-0x0000000000912000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz
Executes dropped EXE 2 IoCs

Processes:

eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmpeditresync32_64.exe

pid process

4500 eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp
3992 editresync32_64.exe
Loads dropped DLL 1 IoCs

Processes:

eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp

pid process

4500 eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 152.89.198.214
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc
Destination IP	152.89.198.214

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

net1.exeeb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.exeeb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmpeditresync32_64.exenet.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	editresync32_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp

pid	process
4500	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp
4500	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp

pid process

4500 eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.exeeb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmpnet.exe

description	pid	process	target process
PID 1844 wrote to memory of 4500	1844	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.exe	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp
PID 1844 wrote to memory of 4500	1844	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.exe	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp
PID 1844 wrote to memory of 4500	1844	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.exe	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp
PID 4500 wrote to memory of 5052	4500	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp	net.exe
PID 4500 wrote to memory of 5052	4500	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp	net.exe
PID 4500 wrote to memory of 5052	4500	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp	net.exe
PID 4500 wrote to memory of 3992	4500	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp	editresync32_64.exe
PID 4500 wrote to memory of 3992	4500	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp	editresync32_64.exe
PID 4500 wrote to memory of 3992	4500	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp	editresync32_64.exe
PID 5052 wrote to memory of 4044	5052	net.exe	net1.exe
PID 5052 wrote to memory of 4044	5052	net.exe	net1.exe
PID 5052 wrote to memory of 4044	5052	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.exe
"C:\Users\Admin\AppData\Local\Temp\eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\is-4DBHN.tmp\eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4DBHN.tmp\eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp" /SL5="$D0046,4565828,56832,C:\Users\Admin\AppData\Local\Temp\eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" pause edit_resync_11123
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 pause edit_resync_11123
      4⤵
      System Location Discovery: System Language Discovery
      PID:4044
- - C:\Users\Admin\AppData\Local\Edit Resync 0.32\editresync32_64.exe
    "C:\Users\Admin\AppData\Local\Edit Resync 0.32\editresync32_64.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Edit Resync 0.32\editresync32_64.exe

Filesize
3.5MB

MD5
c6c1d923438828a566c7ca33c603091c

SHA1
b2ec81c625b20d8cfc5fb24cfc0ad211d1cf5dd5

SHA256
efe8086f830e8ed79d448a13e42414119737bb74c8e2ec65aeec92fe22a64f9b

SHA512
3ca8b36f8506186cb5a0ff34d8cc71c49284d65ffc5eb4d9c61affe9f0acd678f3d48fa7b8c0e784f931e2f5d48cd3d94ee5310ad882a50d6b49119bb4e4e400

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4DBHN.tmp\eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp

Filesize
692KB

MD5
9a99589cc16eff1e7398d990c8bcd9f5

SHA1
af0c7f22ad249cad5d20dd97e0fe4198e9e3b281

SHA256
aa9e35ddeeaf4c667c0cfa9a7dfd185bdaab2322cfcc7bfe95054be4972d408e

SHA512
90bb34209386df6bdeffb599bc819158be470e85945ae6a641610d787f5d3eaf3123d5a698f5ee3b59f74864af1fab96accd3de04e3439df1699c39b2748a71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H47SU.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/1844-73-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1844-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1844-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3992-82-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-92-0x0000000000870000-0x0000000000912000-memory.dmp

Filesize
648KB

Download
memory/3992-71-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-124-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-68-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-75-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-76-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-79-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-121-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-85-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-88-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-69-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-93-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-99-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-102-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-103-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-106-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-109-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-112-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-115-0x0000000000400000-0x000000000077C000-memory.dmp

Filesize
3.5MB

Download
memory/3992-117-0x0000000000870000-0x0000000000912000-memory.dmp

Filesize
648KB

Download
memory/3992-116-0x0000000000870000-0x0000000000912000-memory.dmp

Filesize
648KB

Download
memory/4500-6-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4500-72-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download

pid	process
4500	eb6d02850378e53985bba9d8a61a02adf9a75c8f6f2a11b3f8cfa6200f889371.tmp
3992	editresync32_64.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads