socks5systemz | f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a

General

Target

f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.exe
Size

4.0MB
MD5

3b5e5e15b99a49c9259e7bbd6d64f608
SHA1

2d83d60e66af0b76ecb7087d043a84bb5b783dc1
SHA256

f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a
SHA512

cd243e4e755729e7b8a2ea30ecf3c9c049ed86550210cdc0595b8cf6e0eee631a1a8d2f9b73c4de8ab1f52b4b66cd33eac27dc49effbbf87dc9f3f56f6e72710
SSDEEP

98304:CMZLyZfXNbL+NCRBjdYkU+RsadLypI97NWO:3Zmh84RBjKFAxy0wO

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

ckimvtj.net

http://ckimvtj.net/search/?q=67e28dd8645df12f145cac4c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608afd13c9ee9d933d

http://ckimvtj.net/search/?q=67e28dd8645df12f145cac4c7c27d78406abdd88be4b12eab517aa5c96bd86ef94824e825a8bbc896c58e713bc90c91936b5281fc235a925ed3e07d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7eb979832cc679f10

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/944-66-0x0000000000A00000-0x0000000000AA2000-memory.dmp	family_socks5systemz
behavioral2/memory/944-89-0x0000000000A00000-0x0000000000AA2000-memory.dmp	family_socks5systemz
behavioral2/memory/944-90-0x0000000000A00000-0x0000000000AA2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Socks5systemz family
socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
3228	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp
5772	publicmusicstation.exe
944	publicmusicstation.exe

Loads dropped DLL 1 IoCs

pid	Process
3228	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	32	141.98.234.31	944	publicmusicstation.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	publicmusicstation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	publicmusicstation.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 3228	32	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.exe	86
PID 32 wrote to memory of 3228	32	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.exe	86
PID 32 wrote to memory of 3228	32	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.exe	86
PID 3228 wrote to memory of 5772	3228	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp	89
PID 3228 wrote to memory of 5772	3228	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp	89
PID 3228 wrote to memory of 5772	3228	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp	89
PID 3228 wrote to memory of 944	3228	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp	90
PID 3228 wrote to memory of 944	3228	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp	90
PID 3228 wrote to memory of 944	3228	f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp	90

C:\Users\Admin\AppData\Local\Temp\f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.exe
"C:\Users\Admin\AppData\Local\Temp\f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:32
- C:\Users\Admin\AppData\Local\Temp\is-N9NQE.tmp\f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N9NQE.tmp\f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp" /SL5="$601F2,3830265,54272,C:\Users\Admin\AppData\Local\Temp\f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Users\Admin\AppData\Local\Public Music Station\publicmusicstation.exe
    "C:\Users\Admin\AppData\Local\Public Music Station\publicmusicstation.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5772
- - C:\Users\Admin\AppData\Local\Public Music Station\publicmusicstation.exe
    "C:\Users\Admin\AppData\Local\Public Music Station\publicmusicstation.exe" -s
    3⤵
    - Executes dropped EXE
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Public Music Station\publicmusicstation.exe

Filesize
5.1MB

MD5
8ebaf0731db1abf7e2c7fc439ff6dccc

SHA1
c6731b185bfcda67855989e742e4f810868aa43d

SHA256
8cef411e9e58c519aa8b941daa1cdb14653798fea285fc7f466c571e30867077

SHA512
24274921de5a193c63e785294079e5b0a1a5a6f1f259e9791c95fac5bfc4b03732f5fabd6976ec7467042cfa915461a34244c011b90636e24140acf5ff285251

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-390DG.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N9NQE.tmp\f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a.tmp

Filesize
680KB

MD5
e00c240f47f8a56e6bcd2760d9a313d7

SHA1
adbf31a5b13553423d8edeaf74d630d457073109

SHA256
2232cf1b6bdd8ffc46a2ecb01ce920da2752e0d389f7b7563d2d004aff0bcb86

SHA512
732a5735e4143ddba68c469a0643129d3aa00af4282970fdd4adebd4288a8ed2aac3d9555c7956fa1e66ee43e21b32f4016b963f32cb16b9840c77394a15ec7e

Download Submit
memory/32-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/32-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/32-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/944-88-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-73-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-109-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-106-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-103-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-100-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-51-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-54-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-57-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-60-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-63-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-66-0x0000000000A00000-0x0000000000AA2000-memory.dmp

Filesize
648KB

Download
memory/944-68-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-97-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-76-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-79-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-82-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-85-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-94-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/944-89-0x0000000000A00000-0x0000000000AA2000-memory.dmp

Filesize
648KB

Download
memory/944-90-0x0000000000A00000-0x0000000000AA2000-memory.dmp

Filesize
648KB

Download
memory/3228-7-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3228-48-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/5772-40-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/5772-39-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/5772-45-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download
memory/5772-44-0x0000000000400000-0x0000000000916000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing