socks5systemz | c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31

General

Target

c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.exe
Size

4.8MB
MD5

29ac01cceaa586394ef759cc09ac2d8f
SHA1

095374267db2ec9630cdc9ceac36f64c0342d8f4
SHA256

c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31
SHA512

956b9e211b8eb6accdc88f4e136d76806d98956930d14fd23f7275e6ab12f53eda74efbf2e9977c91bcdfd6bc7a951b274a28cce7f513e682fda10d27c9d4296
SSDEEP

98304:+/mjWrf15MeBRNXFzY5AwvsOXKSLUS+DbuEhFEmfv9ELQC:FWrt5MiYSwvs/SLUmEsmfv90

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

eboyezz.ua

http://eboyezz.ua/search/?q=67e28dd86d0ff42e4008ab1f7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608afd13c8ea96923b

http://eboyezz.ua/search/?q=67e28dd86d0ff42e4008ab1f7c27d78406abdd88be4b12eab517aa5c96bd86e891874c865a8bbc896c58e713bc90c91d36b5281fc235a925ed3e5dd6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7eb979833c86c9e16

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/4440-96-0x0000000002280000-0x0000000002322000-memory.dmp	family_socks5systemz
behavioral2/memory/4440-126-0x0000000002280000-0x0000000002322000-memory.dmp	family_socks5systemz
behavioral2/memory/4440-127-0x0000000002280000-0x0000000002322000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
5764	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp
2508	keratodjprof.exe
4440	keratodjprof.exe

Loads dropped DLL 3 IoCs

pid	Process
5764	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp
5764	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp
5764	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	39	152.89.198.214	4440	keratodjprof.exe
Destination IP	40	91.211.247.248	4440	keratodjprof.exe
Destination IP	37	152.89.198.214	4440	keratodjprof.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keratodjprof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keratodjprof.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 5764	4388	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.exe	86
PID 4388 wrote to memory of 5764	4388	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.exe	86
PID 4388 wrote to memory of 5764	4388	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.exe	86
PID 5764 wrote to memory of 2508	5764	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp	89
PID 5764 wrote to memory of 2508	5764	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp	89
PID 5764 wrote to memory of 2508	5764	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp	89
PID 5764 wrote to memory of 4440	5764	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp	90
PID 5764 wrote to memory of 4440	5764	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp	90
PID 5764 wrote to memory of 4440	5764	c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp	90

C:\Users\Admin\AppData\Local\Temp\c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.exe
"C:\Users\Admin\AppData\Local\Temp\c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Local\Temp\is-8KOAH.tmp\c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8KOAH.tmp\c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp" /SL5="$5027A,4789018,54272,C:\Users\Admin\AppData\Local\Temp\c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Users\Admin\AppData\Local\Kerato DJ Prof\keratodjprof.exe
    "C:\Users\Admin\AppData\Local\Kerato DJ Prof\keratodjprof.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2508
- - C:\Users\Admin\AppData\Local\Kerato DJ Prof\keratodjprof.exe
    "C:\Users\Admin\AppData\Local\Kerato DJ Prof\keratodjprof.exe" -s
    3⤵
    - Executes dropped EXE
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Kerato DJ Prof\keratodjprof.exe

Filesize
1.9MB

MD5
b67facabf7da66e858b38bebba9c283d

SHA1
975b5b055d118b7d4bacbbb98fc1fed944355bbe

SHA256
4a792ac3ec1c58da1d3e819dde9025d91b7771256fe4f11dec25f1c603e55f11

SHA512
a02c612a848b3a2003e0db4dbc2df3c666b601cf7e7fb2d112787b69b4adc635cd60f0ade3474f40796ef59340ebbbb3323c0c73ed1977fd279e54ed946cc95e

Download Submit
C:\Users\Admin\AppData\Local\Kerato DJ Prof\libeay32.dll

Filesize
1.9MB

MD5
876a839023b8f962a72d295da7495734

SHA1
62a7728679bc18784b1fbf1d013f7cece18cbec9

SHA256
a757d773da406411fb977761f6e56f016d48d224aedaf3d875ed4d4a9ede6158

SHA512
e1b23a2f5ec0100ff874ca075bbd0f90e9065a90fec66861f99df603d7aaa9db8e8ec326710fdc11ad41d01befe4ea3077136127acf613614d0d12ff23bec6c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5DOPO.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5DOPO.tmp\_isetup\_isdecmp.dll

Filesize
19KB

MD5
c948b46ea1eb5757ecf75404571c31ce

SHA1
6665b8d48fea3538c7e043b7ab700778d86307a3

SHA256
3c5b63d61e00f30790c7df0f048473cb04d17e175d8177e86c7cf5062dcaad24

SHA512
6b326b34c8142ef2b75df7f83aed11400a86d19806730bab0515ccfcd6eb2ef71d6db707dbd48d8f1f8ff9e3eb6626af80d38394ebaf2742ef3df0d0ebe4f256

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8KOAH.tmp\c17e74cb20150f2e5a810112eb1234a1f54523db1080cc4d0652a61a74802f31.tmp

Filesize
696KB

MD5
95a2740ed7e8495d4e520a20175629d0

SHA1
5da0777a4eda539160fd1081b626045abb9089dd

SHA256
bc85d48ba9608273f37a0a7775147d5cd17669949c17a27c833f2e40ba9d5c11

SHA512
7006dc66776392c3abb3ce719028ec239365f2beb29f3ff613b202400673d01c8b41b45d85d3997839977635708d81713f860dde076e7a431498b06d6939fee8

Download Submit
memory/2508-65-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/2508-69-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/2508-66-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/2508-70-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4388-76-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4388-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4388-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4440-83-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-104-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-74-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-77-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-79-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-80-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-140-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-86-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-89-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-92-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-96-0x0000000002280000-0x0000000002322000-memory.dmp

Filesize
648KB

Download
memory/4440-97-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-103-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-137-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-107-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-110-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-113-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-116-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-119-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-122-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-125-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-126-0x0000000002280000-0x0000000002322000-memory.dmp

Filesize
648KB

Download
memory/4440-127-0x0000000002280000-0x0000000002322000-memory.dmp

Filesize
648KB

Download
memory/4440-131-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4440-134-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/5764-75-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/5764-10-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download

Analysis

Sharing