socks5systemz | e880e19545c1a04e0cced43714c2c027fa1cc8558499091dae57a3675b9fc82c

General

Target

42WFo3FaTHYyBEwuU2uDHxNr.exe
Size

7.6MB
MD5

98f743c21a83ff1ebb7a55b3d32ac099
SHA1

e715b3eb8a3518369d20012533d4cc8eb8950749
SHA256

e880e19545c1a04e0cced43714c2c027fa1cc8558499091dae57a3675b9fc82c
SHA512

5fe640e5c9b6bc9dc8ace041b20ce5b9f1190b010aeabc13e17310220ec4352e025b22d9a2ec876a83e0bf8088e4b30cd7e43dd9a47904d6df9b639bfba39452
SSDEEP

196608:DnIjlo7SWx8ktMWfDsRhcI76Mrmaa6t9BHKNPv/94s23rG04BbpmBj:DIhoeWxwW7sRhr6Mrmaaq9BqN3/9oZ0S

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3732-104-0x0000000000D80000-0x0000000000E22000-memory.dmp	family_socks5systemz
behavioral2/memory/3732-128-0x0000000000D80000-0x0000000000E22000-memory.dmp	family_socks5systemz
behavioral2/memory/3732-127-0x0000000000D80000-0x0000000000E22000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz

Executes dropped EXE 2 IoCs

pid	Process
3348	is-ISRLM.tmp
3732	jennysoftvideoeditor32.exe

Loads dropped DLL 1 IoCs

pid	Process
3348	is-ISRLM.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42WFo3FaTHYyBEwuU2uDHxNr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	is-ISRLM.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jennysoftvideoeditor32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 3348	416	42WFo3FaTHYyBEwuU2uDHxNr.exe	81
PID 416 wrote to memory of 3348	416	42WFo3FaTHYyBEwuU2uDHxNr.exe	81
PID 416 wrote to memory of 3348	416	42WFo3FaTHYyBEwuU2uDHxNr.exe	81
PID 3348 wrote to memory of 3732	3348	is-ISRLM.tmp	82
PID 3348 wrote to memory of 3732	3348	is-ISRLM.tmp	82
PID 3348 wrote to memory of 3732	3348	is-ISRLM.tmp	82

C:\Users\Admin\AppData\Local\Temp\42WFo3FaTHYyBEwuU2uDHxNr.exe
"C:\Users\Admin\AppData\Local\Temp\42WFo3FaTHYyBEwuU2uDHxNr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:416
- C:\Users\Admin\AppData\Local\Temp\is-E1RCG.tmp\is-ISRLM.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-E1RCG.tmp\is-ISRLM.tmp" /SL4 $70166 "C:\Users\Admin\AppData\Local\Temp\42WFo3FaTHYyBEwuU2uDHxNr.exe" 7717549 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Users\Admin\AppData\Local\Jennysoft Video Editor\jennysoftvideoeditor32.exe
    "C:\Users\Admin\AppData\Local\Jennysoft Video Editor\jennysoftvideoeditor32.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Jennysoft Video Editor\jennysoftvideoeditor32.exe

Filesize
8.5MB

MD5
9115b542d4b1a9d7f8687b0b046ee8ca

SHA1
b36570fc05c0ea3902bc9fad3c6bd94939aa8227

SHA256
01fabcf19194dce2115fc2f5aa11c12aac16d5089bca0cd7644038b6ed14f4da

SHA512
e8aa22e223f46ba92513d74eda4e3e4ae9711e1813285036c47470766d4d5015ca4e1b2848f4511ae01a9261dbb14351372b11a4e52adafa7837c65540436d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E1RCG.tmp\is-ISRLM.tmp

Filesize
647KB

MD5
fef9f37b0bf2bfe2b6fca576c965a691

SHA1
4feb38c272b8dfb6b0cd96eeb1dbf76e03dfebb4

SHA256
2217b8b847bffac814c809c6ba9cd7117420893683e5e0b69f92f656c7db9141

SHA512
1f6c75c422b3ec8f5e4ffce2d155d69f07df0ac2e74ac90d439c01a7587164b8900c514134123824ad06120ff0a2bbbf8daed6f1b832be8a867c51c5c5bf1752

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q13VH.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/416-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/416-2-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/416-85-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3348-84-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3348-7-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3732-94-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-110-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-80-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-87-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-88-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-91-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-79-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-97-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-100-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-103-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-104-0x0000000000D80000-0x0000000000E22000-memory.dmp

Filesize
648KB

Download
memory/3732-83-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-113-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-114-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-117-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-120-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-123-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-126-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-128-0x0000000000D80000-0x0000000000E22000-memory.dmp

Filesize
648KB

Download
memory/3732-127-0x0000000000D80000-0x0000000000E22000-memory.dmp

Filesize
648KB

Download
memory/3732-132-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download
memory/3732-135-0x0000000000400000-0x0000000000C82000-memory.dmp

Filesize
8.5MB

Download

Analysis

Sharing