socks5systemz | 5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.exe
Size

5.0MB
MD5

c098529196a51f8fec19fbea629cf2dd
SHA1

c6c12b6c9664c5ccc09c5f50b12cb0f25922ecc5
SHA256

5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed
SHA512

da1f08d470607f2a115e68cfb0091f65c56a744a0965e0de45591e0378b353a29ab49fae1b6ba9f3d530ba00c85a5f7f3e4574913bc4ee6ad921a4db800ef485
SSDEEP

98304:CFov53LUf9QrY2OTow4bVSHu9YkJmHSq5+vC07q7t2ydTJ2WQxcMv:N3Ife8YbVSHsISa+q07qZNTzQW8

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

ebfwzwu.ua

http://ebfwzwu.ua/search/?q=67e28dd8685ff37d4306f81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff614c3ea949b32

http://ebfwzwu.ua/search/?q=67e28dd8685ff37d4306f81a7c27d78406abdd88be4b12eab517aa5c96bd86eb968f4e96148ab2865b77f80ebad9c60f7cb63037ed2ab423a4374383ba915d911ec07bb606a0708727e40ea678c45abbe74ffb0e2807e12571c17f3e83fe16c1e690993ecc6e9f

Signatures

Detect Socks5Systemz Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1828-86-0x00000000025B0000-0x0000000002652000-memory.dmp	family_socks5systemz
behavioral1/memory/1828-109-0x00000000025B0000-0x0000000002652000-memory.dmp	family_socks5systemz
behavioral1/memory/1828-110-0x00000000025B0000-0x0000000002652000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmpwavmp3splitter32.exewavmp3splitter32.exe

pid process

3576 5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp
4528 wavmp3splitter32.exe
1828 wavmp3splitter32.exe
Loads dropped DLL 1 IoCs

Processes:

5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp

pid process

3576 5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 45.155.250.90
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp

pid process

3576 5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp

pid	process
3576	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp
4528	wavmp3splitter32.exe
1828	wavmp3splitter32.exe

pid	process
3576	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp

description	ioc
Destination IP	45.155.250.90

pid	process
3576	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.exe5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp

description	pid	process	target process
PID 4384 wrote to memory of 3576	4384	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.exe	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp
PID 4384 wrote to memory of 3576	4384	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.exe	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp
PID 4384 wrote to memory of 3576	4384	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.exe	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp
PID 3576 wrote to memory of 4528	3576	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp	wavmp3splitter32.exe
PID 3576 wrote to memory of 4528	3576	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp	wavmp3splitter32.exe
PID 3576 wrote to memory of 4528	3576	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp	wavmp3splitter32.exe
PID 3576 wrote to memory of 1828	3576	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp	wavmp3splitter32.exe
PID 3576 wrote to memory of 1828	3576	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp	wavmp3splitter32.exe
PID 3576 wrote to memory of 1828	3576	5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp	wavmp3splitter32.exe

C:\Users\Admin\AppData\Local\Temp\5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.exe
"C:\Users\Admin\AppData\Local\Temp\5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4384

C:\Users\Admin\AppData\Local\Temp\is-M636O.tmp\5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M636O.tmp\5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp" /SL5="$100052,5036340,54272,C:\Users\Admin\AppData\Local\Temp\5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3576

C:\Users\Admin\AppData\Local\Direct WAV MP3 Splitter\wavmp3splitter32.exe
"C:\Users\Admin\AppData\Local\Direct WAV MP3 Splitter\wavmp3splitter32.exe" -i
3⤵
- Executes dropped EXE
PID:4528

C:\Users\Admin\AppData\Local\Direct WAV MP3 Splitter\wavmp3splitter32.exe
"C:\Users\Admin\AppData\Local\Direct WAV MP3 Splitter\wavmp3splitter32.exe" -s
3⤵
- Executes dropped EXE
PID:1828

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Direct WAV MP3 Splitter\wavmp3splitter32.exe
Filesize
3.5MB

MD5
7fd72d50bd28c11f4cd1948d7e0eb5ea

SHA1
518a3df5f498afdc1ec0180e050fe36b24651c73

SHA256
7ec611e1d400d7288168ab15bc0cdbd670bed9eb15e830ad2fd0ae965c00c34d

SHA512
ab6cfe9a73011cf1f3bd04452dd599d699b11c941ba90820da6e33278d7353da37ebd61ae0cf496fe064aaa0a9ddf504f64a0c9ae7283ff9e503b6f7a1ce0ccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HUVDN.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M636O.tmp\5b6ebab805cf5ca06a133be07b6f68e95b6cfd103872a05547cbc66022cfcfed.tmp
Filesize
680KB

MD5
59177ea3e8147d91b694e9949c60d194

SHA1
5c8cfd3fcccd7be056c7c0e2e4fc063c38dc14bd

SHA256
9687ab4b33b1a083194713be5a0f872ebb949773b832a20063a507073859e28c

SHA512
a235dab7d5dc6652f5f8256c1e2c19aef2f583ead02a920ee17658eeb64e8a9620767594d7e4b6ca4aa030643821133c1a18823c55ea769d3221383927ea8a08

Download Submit
memory/1828-96-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-79-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-117-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-114-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-110-0x00000000025B0000-0x0000000002652000-memory.dmp

Filesize
648KB

Download
memory/1828-109-0x00000000025B0000-0x0000000002652000-memory.dmp

Filesize
648KB

Download
memory/1828-108-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-67-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-105-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-102-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-70-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-73-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-76-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-99-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-82-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-87-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/1828-86-0x00000000025B0000-0x0000000002652000-memory.dmp

Filesize
648KB

Download
memory/1828-93-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/3576-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3576-69-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4384-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4384-68-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4384-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4528-63-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/4528-64-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/4528-60-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download
memory/4528-59-0x0000000000400000-0x0000000000783000-memory.dmp

Filesize
3.5MB

Download