socks5systemz | 7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace

General

Target

7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.exe
Size

4.7MB
MD5

85a22fae27ef9ca84832e1947f753cfa
SHA1

88da04d98d05904d0dff735e789dd58e479bf526
SHA256

7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace
SHA512

07b61d7bdb779c9ca5cc292f5565b8b09daa4d4ffcf32babadc1245a7381aad166a4a70cdcc578d06250780f269fe0461722b544766edbb38fb557c6c2c271d0
SSDEEP

98304:4m7Gd2jbNHTlvj9R6PzLxHUhDhd17GKj0qdmDgRehJZVU/:57gUbZGXx0f77GKRmr2

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2344-92-0x0000000000AC0000-0x0000000000B62000-memory.dmp	family_socks5systemz
behavioral2/memory/2344-115-0x0000000000AC0000-0x0000000000B62000-memory.dmp	family_socks5systemz
behavioral2/memory/2344-116-0x0000000000AC0000-0x0000000000B62000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz
Executes dropped EXE 2 IoCs

Processes:

7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmpeditresync32.exe

pid process

3604 7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp
2344 editresync32.exe
Loads dropped DLL 1 IoCs

Processes:

7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp

pid process

3604 7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 152.89.198.214
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc
Destination IP	152.89.198.214

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.exe7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmpeditresync32.exenet.exenet1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	editresync32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp

pid	process
3604	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp
3604	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp

pid process

3604 7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.exe7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmpnet.exe

description	pid	process	target process
PID 2512 wrote to memory of 3604	2512	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.exe	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp
PID 2512 wrote to memory of 3604	2512	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.exe	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp
PID 2512 wrote to memory of 3604	2512	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.exe	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp
PID 3604 wrote to memory of 4560	3604	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp	net.exe
PID 3604 wrote to memory of 4560	3604	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp	net.exe
PID 3604 wrote to memory of 4560	3604	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp	net.exe
PID 3604 wrote to memory of 2344	3604	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp	editresync32.exe
PID 3604 wrote to memory of 2344	3604	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp	editresync32.exe
PID 3604 wrote to memory of 2344	3604	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp	editresync32.exe
PID 4560 wrote to memory of 2260	4560	net.exe	net1.exe
PID 4560 wrote to memory of 2260	4560	net.exe	net1.exe
PID 4560 wrote to memory of 2260	4560	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.exe
"C:\Users\Admin\AppData\Local\Temp\7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\is-PV2QO.tmp\7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PV2QO.tmp\7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp" /SL5="$70052,4643638,56832,C:\Users\Admin\AppData\Local\Temp\7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" pause edit_resync_11122
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 pause edit_resync_11122
      4⤵
      System Location Discovery: System Language Discovery
      PID:2260
- - C:\Users\Admin\AppData\Local\Edit Resync 3.7.40\editresync32.exe
    "C:\Users\Admin\AppData\Local\Edit Resync 3.7.40\editresync32.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Edit Resync 3.7.40\editresync32.exe

Filesize
3.5MB

MD5
3488fcfca8973f5c5b8e702163988af8

SHA1
2a0ba6009bff29aa884d5d0a934c35ee92cebe69

SHA256
20651b9639686f029a9cf2ea66c44ed28f9b9eceaad5e14b7dab5ac3bd38e55a

SHA512
f234de3ede530f1f6977e8d39f0db4d8e3bb85bfe8627926ba530772e1a86291247290df35d2a888f6b609968ba8b6bcea2dc2f7233ed792e3424bc5f0624289

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LS79O.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PV2QO.tmp\7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp

Filesize
692KB

MD5
e39b95e28e737e93760a30dbb74c6859

SHA1
5b320e9a3a393ab86fbbbbecc56fcf733a549b0d

SHA256
09a14a6e48a2175de222f7788ea3ea2fd2df4a719350ddccf17f910aa14cef31

SHA512
36a795f8a092287603c20cb311f09522c1791e5a8bbee0fa6c892d16eebb00213cef05589ffd3d8401c7fc59abcd2489c70b76f31284666dd444d7ab8dd62328

Download Submit
memory/2344-82-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-105-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-123-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-68-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-69-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-71-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-120-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-116-0x0000000000AC0000-0x0000000000B62000-memory.dmp

Filesize
648KB

Download
memory/2344-75-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-76-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-79-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-115-0x0000000000AC0000-0x0000000000B62000-memory.dmp

Filesize
648KB

Download
memory/2344-85-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-88-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-92-0x0000000000AC0000-0x0000000000B62000-memory.dmp

Filesize
648KB

Download
memory/2344-91-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-98-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-101-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-102-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-114-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-108-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2344-111-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/2512-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2512-73-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2512-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3604-6-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3604-72-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download

pid	process
3604	7c31ade1f1f9df539451e33d1ec0cee163708a07592674ecaca5f4a37c02cace.tmp
2344	editresync32.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads