socks5systemz | 821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2

General

Target

821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.exe
Size

4.9MB
MD5

51ea0eae085f7c3a367668d1f2b8a211
SHA1

7a8358a07934f98476b460cd247aba76984f110f
SHA256

821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2
SHA512

c047d325a114e3eabca7abb4a2b914dac74a4517c9d2f3b24ee10db0c011e42fdf62ae793e4441275eba9bbd569dc368cff20b50b7ff6e97ae6be18bd7f88cb2
SSDEEP

98304:+vpeuT+kIh/dCl3DU/XWNXQHVUCdwLWNOG77v+XwREOb2yLT3d1ZW6:KptI/dKiXQXaUTGzEOb/TNXW6

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

buhnlmd.com

http://buhnlmd.com/search/?q=67e28dd83a09f729130ead4a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608afd13c7ea9c9c33

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4640-96-0x0000000000900000-0x00000000009A2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
3636	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp
4784	cdstudio.exe
4640	cdstudio.exe

Loads dropped DLL 3 IoCs

pid	Process
3636	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp
3636	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp
3636	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	43	91.211.247.248	4640	cdstudio.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdstudio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdstudio.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3636	3672	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.exe	86
PID 3672 wrote to memory of 3636	3672	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.exe	86
PID 3672 wrote to memory of 3636	3672	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.exe	86
PID 3636 wrote to memory of 4784	3636	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp	90
PID 3636 wrote to memory of 4784	3636	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp	90
PID 3636 wrote to memory of 4784	3636	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp	90
PID 3636 wrote to memory of 4640	3636	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp	91
PID 3636 wrote to memory of 4640	3636	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp	91
PID 3636 wrote to memory of 4640	3636	821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp	91

C:\Users\Admin\AppData\Local\Temp\821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.exe
"C:\Users\Admin\AppData\Local\Temp\821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\is-18LV5.tmp\821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-18LV5.tmp\821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp" /SL5="$90204,4858283,54272,C:\Users\Admin\AppData\Local\Temp\821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Users\Admin\AppData\Local\CD Studio\cdstudio.exe
    "C:\Users\Admin\AppData\Local\CD Studio\cdstudio.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4784
- - C:\Users\Admin\AppData\Local\CD Studio\cdstudio.exe
    "C:\Users\Admin\AppData\Local\CD Studio\cdstudio.exe" -s
    3⤵
    - Executes dropped EXE
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\CD Studio\cdstudio.exe

Filesize
2.2MB

MD5
33cfae5213549b9ceeba3cd54d705682

SHA1
f8947b98962c3281a07119adbfde84ab2e38b564

SHA256
a9f49254b8c688842b337f8d4dfe4adb78cb042dd9de1dfa08db5e2f8b06611b

SHA512
0654d5b17b3215bb42ef0b231e079dedc42402ca6eab933a6e928184959d17b189cca2fc7e35ed92e7ab93f8faa149d8e9b388c2e2daf465c976eedf05164707

Download Submit
C:\Users\Admin\AppData\Local\CD Studio\libeay32.dll

Filesize
2.0MB

MD5
1176a2fcbc3cfb77207db7575dd6a522

SHA1
e0a854c77a65e542712c9fe3feae2331fcddb7f4

SHA256
553200e21658e7976d496c52cc1aeb50446b877ccda4f0b073a553ec3fb48560

SHA512
bb00340e4931342c4db499d68e98542f401a985c062810225ee661a7a289a885dab8c64f37fb231212ad2a5d703f3fd0528e8402fc1033cf4128d075714e3f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-18LV5.tmp\821c9a378c2b54ee9f162cf6441bae5a60759079297eca250981cb54f82ce7c2.tmp

Filesize
695KB

MD5
15e19cc2c5ec8ecaa43f6afe7e08b884

SHA1
7eda3d0dbedf7da5a37bb97b9e560fe638e04681

SHA256
8372e7a1c21103353b4803647556d3aba124ff94ac760dc825ad36ef341fa7b7

SHA512
a4d90590101a8f0de6b22c0fa7b408d8101c1dbfdf43250483930d24331782efb89e3b9c124849b4c1cedbe5330369448cd4908b70319f0c04e53feff7a170fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DVIAC.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DVIAC.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b6f11a0ab7715f570f45900a1fe84732

SHA1
77b1201e535445af5ea94c1b03c0a1c34d67a77b

SHA256
e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67

SHA512
78a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771

Download Submit
memory/3636-9-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3636-76-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3672-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3672-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3672-77-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4640-113-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-104-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-75-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-143-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-138-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-79-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-80-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-83-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-86-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-89-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-92-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-97-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-96-0x0000000000900000-0x00000000009A2000-memory.dmp

Filesize
648KB

Download
memory/4640-135-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-103-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-107-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-110-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-132-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-116-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-119-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-123-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-126-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4640-129-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4784-65-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4784-71-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4784-66-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/4784-69-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing