socks5systemz | af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817

General

Target

af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.exe
Size

5.0MB
MD5

302802b2b5512a5428a68d3906bdbe93
SHA1

90f24f51d7830db5d880fb2db844822fe4ecd0a0
SHA256

af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817
SHA512

62c053266d316fb9a830f8775a4d94f45be72eaadb1e01714c695f3fc6e345a4e7570b40525872361d636a8267f88a182bcd1927861d8afe8f12cb4ef9f2bd89
SSDEEP

98304:+1QLjkx3+qB7+uc7VAtXx1AuFBnskRko4YAnUMpqK7Cf4G/sstsQd1ZDlBx:msT32thPskREYAn0K7C//siXzx

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

ayhdepd.ru

http://ayhdepd.ru/search/?q=67e28dd83e5aa079125baa1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608afd13c8ed90983a

http://ayhdepd.ru/search/?q=67e28dd83e5aa079125baa1a7c27d78406abdd88be4b12eab517aa5c96bd86e994844e895a8bbc896c58e713bc90c91c36b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7eb979833cf6a9417

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1088-98-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz
behavioral2/memory/1088-128-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz
behavioral2/memory/1088-129-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
3272	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp
320	perfectmetronomesoftware.exe
1088	perfectmetronomesoftware.exe

Loads dropped DLL 3 IoCs

pid	Process
3272	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp
3272	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp
3272	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	42	152.89.198.214	1088	perfectmetronomesoftware.exe
Destination IP	44	152.89.198.214	1088	perfectmetronomesoftware.exe
Destination IP	45	91.211.247.248	1088	perfectmetronomesoftware.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfectmetronomesoftware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfectmetronomesoftware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 3272	3636	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.exe	88
PID 3636 wrote to memory of 3272	3636	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.exe	88
PID 3636 wrote to memory of 3272	3636	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.exe	88
PID 3272 wrote to memory of 320	3272	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp	91
PID 3272 wrote to memory of 320	3272	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp	91
PID 3272 wrote to memory of 320	3272	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp	91
PID 3272 wrote to memory of 1088	3272	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp	92
PID 3272 wrote to memory of 1088	3272	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp	92
PID 3272 wrote to memory of 1088	3272	af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp	92

C:\Users\Admin\AppData\Local\Temp\af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.exe
"C:\Users\Admin\AppData\Local\Temp\af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\AppData\Local\Temp\is-OSD0D.tmp\af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OSD0D.tmp\af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp" /SL5="$50202,4943452,54272,C:\Users\Admin\AppData\Local\Temp\af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Users\Admin\AppData\Local\Perfect Metronome Software\perfectmetronomesoftware.exe
    "C:\Users\Admin\AppData\Local\Perfect Metronome Software\perfectmetronomesoftware.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:320
- - C:\Users\Admin\AppData\Local\Perfect Metronome Software\perfectmetronomesoftware.exe
    "C:\Users\Admin\AppData\Local\Perfect Metronome Software\perfectmetronomesoftware.exe" -s
    3⤵
    - Executes dropped EXE
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Perfect Metronome Software\libeay32.dll

Filesize
2.0MB

MD5
1176a2fcbc3cfb77207db7575dd6a522

SHA1
e0a854c77a65e542712c9fe3feae2331fcddb7f4

SHA256
553200e21658e7976d496c52cc1aeb50446b877ccda4f0b073a553ec3fb48560

SHA512
bb00340e4931342c4db499d68e98542f401a985c062810225ee661a7a289a885dab8c64f37fb231212ad2a5d703f3fd0528e8402fc1033cf4128d075714e3f34

Download Submit
C:\Users\Admin\AppData\Local\Perfect Metronome Software\perfectmetronomesoftware.exe

Filesize
1.9MB

MD5
f70f676d854f61a4b3f03f9da4ff0c4a

SHA1
e873ccc3384a7da17cbcb384718104717c8e6d3c

SHA256
da1b807ee2107de16dd9bad197a42a2cb80a4852dec64dedf53355117c5c6741

SHA512
3386a0e9c205294f952b3f3e8d1dac4f003db75ddc75ab0392e5404fbf1355d1e787f0cb654355361c037bc3063d251e8a5c200c9b669b2a44411566884df9c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J1PF0.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J1PF0.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OSD0D.tmp\af04d97db0789ae6583eaa17aeda1bb8f5262167262d8e329cbe1e5791010817.tmp

Filesize
695KB

MD5
db24444fa47ba3dbc4c3dede3cb968f0

SHA1
688e63a78c63230b6cc61e4fab772ade1e90ff84

SHA256
09898f414e1897a826e277b39c53326cd6761b0f984bf2626d86878b0f961a46

SHA512
5ab5d5eebd5f34fa580e86a21bfdde0e9382d906449ab67acb4d9e7767bdca81cb6701aa2b88cd27414f134977db329b7ea3ae9b412b623427222b052bc771e9

Download Submit
memory/320-69-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/320-71-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/320-65-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/320-66-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-88-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-98-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/1088-142-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-75-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-76-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-139-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-78-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-136-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-81-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-82-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-85-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-133-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-91-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-94-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-99-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-129-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/1088-105-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-106-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-109-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-112-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-115-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-118-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-121-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-124-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-127-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1088-128-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/3272-10-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3272-77-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3636-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3636-79-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3636-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing