socks5systemz | dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d

General

Target

dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.exe
Size

5.2MB
MD5

08f15b3680d4efd7fa89c0dbeb01db7c
SHA1

a1badddbbd31fe4ce1b465d240258955f561a5f0
SHA256

dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d
SHA512

245ab42852b49f78f46908ebceb4f8e6a6afbce44b35af89975201591a2f56a2e49a7613a1b2f77803c04379660f7315eec54ee268eb8bc6391f7ace645dd772
SSDEEP

98304:+tpyR9r4cTwsMTJXu83Bt+pDVyFVUoSeqtvvij0nkz7d1ZKQ:Rb4bsMTFuStegVUKqt3ijHRXKQ

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

dltyiwc.info

http://dltyiwc.info/search/?q=67e28dd8645df12f145cac4c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608afd13c8e79c923c

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2488-95-0x00000000007A0000-0x0000000000842000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2660	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp
4200	bestmetronome.exe
2488	bestmetronome.exe

Loads dropped DLL 3 IoCs

pid	Process
2660	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp
2660	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp
2660	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	41	91.211.247.248	2488	bestmetronome.exe
Destination IP	37	141.98.234.31	2488	bestmetronome.exe
Destination IP	39	152.89.198.214	2488	bestmetronome.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bestmetronome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bestmetronome.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2660	2036	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.exe	86
PID 2036 wrote to memory of 2660	2036	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.exe	86
PID 2036 wrote to memory of 2660	2036	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.exe	86
PID 2660 wrote to memory of 4200	2660	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp	88
PID 2660 wrote to memory of 4200	2660	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp	88
PID 2660 wrote to memory of 4200	2660	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp	88
PID 2660 wrote to memory of 2488	2660	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp	89
PID 2660 wrote to memory of 2488	2660	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp	89
PID 2660 wrote to memory of 2488	2660	dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp	89

C:\Users\Admin\AppData\Local\Temp\dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.exe
"C:\Users\Admin\AppData\Local\Temp\dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\is-T1LL6.tmp\dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-T1LL6.tmp\dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp" /SL5="$A027E,5185493,54272,C:\Users\Admin\AppData\Local\Temp\dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Users\Admin\AppData\Local\Best Metronome\bestmetronome.exe
    "C:\Users\Admin\AppData\Local\Best Metronome\bestmetronome.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4200
- - C:\Users\Admin\AppData\Local\Best Metronome\bestmetronome.exe
    "C:\Users\Admin\AppData\Local\Best Metronome\bestmetronome.exe" -s
    3⤵
    - Executes dropped EXE
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Best Metronome\bestmetronome.exe

Filesize
2.0MB

MD5
cffd5e84560d51aff4e4775a27850c18

SHA1
184f877bac28734907d34dab809301b6b8a11145

SHA256
cb4d84b89de4b399616a1ee828288bdbf708ba11aea80781ab4a286b6843d543

SHA512
1a6215252a10d6505930ee6e457467c31146464b50a1391d107173ca3298441a78971d3652c1bc9b1ba05af1fda359e19f9cc632f55139e93cf5e79ac55bb4da

Download Submit
C:\Users\Admin\AppData\Local\Best Metronome\libeay32.dll

Filesize
2.0MB

MD5
1176a2fcbc3cfb77207db7575dd6a522

SHA1
e0a854c77a65e542712c9fe3feae2331fcddb7f4

SHA256
553200e21658e7976d496c52cc1aeb50446b877ccda4f0b073a553ec3fb48560

SHA512
bb00340e4931342c4db499d68e98542f401a985c062810225ee661a7a289a885dab8c64f37fb231212ad2a5d703f3fd0528e8402fc1033cf4128d075714e3f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OUQ46.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OUQ46.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-T1LL6.tmp\dbacc22a10297607bfdbdd3c671c038faf0d344fd7c42acc7da2b6795bb6ff8d.tmp

Filesize
695KB

MD5
7e320e53116aa283f49aea5621767843

SHA1
41c61668f5f4ead267b92a32f13df38b29387503

SHA256
0e3d6b29d5084b2478e228602a9c0bb025b7319d0694db00ff270c616e88261f

SHA512
7dfd1146a396b40957cefd8d83f09576726dd4bea8dcca8f67ce851121695bc7ab6ed0b10394d714b18a74ff8cae7b64d80ce3ce743870b59aec54e3d8833172

Download Submit
memory/2036-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2036-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2036-76-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2488-85-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-96-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-138-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-135-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-74-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-132-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-129-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-78-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-79-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-82-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-126-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-88-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-91-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-123-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-95-0x00000000007A0000-0x0000000000842000-memory.dmp

Filesize
648KB

Download
memory/2488-102-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-105-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-108-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-111-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-114-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-117-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2488-120-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2660-13-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2660-75-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4200-66-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/4200-65-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/4200-70-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/4200-69-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing