socks5systemz | ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.exe
Size

4.9MB
MD5

69bb01a23d5634c7585f84bf6484fbef
SHA1

b9c54ebd5556d10371d2c6397f97209855e00e4f
SHA256

ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9
SHA512

43d8c6e4759dba01e4142ee63ebb04f0665475c7c83653fef23c6c8ad3dfe0317cd41dfd3ffde1e728b8d5f3161dc2eaba948a3b7422153ee7f4edc4cc42b1bc
SSDEEP

98304:CQihZf6BzBx0ecVgiYfIp8khajkMA8pnJX5JC+OsAFNlxoXu7BN0zzNQxV:ZiWt6OiYQJhajFnRHL4FN0XK0PNQH

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/4496-86-0x0000000000A30000-0x0000000000AD1000-memory.dmp family_socks5systemz
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmpvkfreeaudiosaver.exevkfreeaudiosaver.exe

pid process

4724 ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp
1252 vkfreeaudiosaver.exe
4496 vkfreeaudiosaver.exe
Loads dropped DLL 1 IoCs

Processes:

ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp

pid process

4724 ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 152.89.198.214
Destination IP 45.155.250.90
Destination IP 91.211.247.248
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp

pid process

4724 ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp

resource	yara_rule
behavioral1/memory/4496-86-0x0000000000A30000-0x0000000000AD1000-memory.dmp	family_socks5systemz

pid	process
4724	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp
1252	vkfreeaudiosaver.exe
4496	vkfreeaudiosaver.exe

pid	process
4724	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp

description	ioc
Destination IP	152.89.198.214
Destination IP	45.155.250.90
Destination IP	91.211.247.248

pid	process
4724	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.exece4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp

description	pid	process	target process
PID 4456 wrote to memory of 4724	4456	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.exe	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp
PID 4456 wrote to memory of 4724	4456	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.exe	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp
PID 4456 wrote to memory of 4724	4456	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.exe	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp
PID 4724 wrote to memory of 1252	4724	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp	vkfreeaudiosaver.exe
PID 4724 wrote to memory of 1252	4724	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp	vkfreeaudiosaver.exe
PID 4724 wrote to memory of 1252	4724	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp	vkfreeaudiosaver.exe
PID 4724 wrote to memory of 4496	4724	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp	vkfreeaudiosaver.exe
PID 4724 wrote to memory of 4496	4724	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp	vkfreeaudiosaver.exe
PID 4724 wrote to memory of 4496	4724	ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp	vkfreeaudiosaver.exe

C:\Users\Admin\AppData\Local\Temp\ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.exe
"C:\Users\Admin\AppData\Local\Temp\ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4456

C:\Users\Admin\AppData\Local\Temp\is-EEN2O.tmp\ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp
"C:\Users\Admin\AppData\Local\Temp\is-EEN2O.tmp\ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp" /SL5="$701E8,4938682,54272,C:\Users\Admin\AppData\Local\Temp\ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4724

C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver.exe
"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver.exe" -i
3⤵
- Executes dropped EXE
PID:1252

C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver.exe
"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver.exe" -s
3⤵
- Executes dropped EXE
PID:4496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-ABRHO.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EEN2O.tmp\ce4e3ca68c981a138b64bc1d2ef80ee3f1ef0b0a3c375b09540448ae670e2ba9.tmp
Filesize
680KB

MD5
81a4349113f841230dac446072c218c6

SHA1
f67d0c915f5308353fa2c0b7e9297304aa4b62a8

SHA256
a52043836914c30737a5d4fdcde7292ac05b8033fd6dadc398aa4b8d9fd6b9b4

SHA512
bf8124df06fb779cc269856448df974eec2f49a274b44c021bc3952758aec2de38455ee716ef233b229c0e98487c2f9ff02b659f745d4f8b866a9dd63fab5464

Download Submit
C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver.exe
Filesize
3.3MB

MD5
222a261e9fee5b62f9e1036e7f959d2a

SHA1
e875efff1ecba6bd03e94c0b8e71dec1dd6e0205

SHA256
5dd166affc41f7ccbeeadd1631f474ffc2f54f701e0241397ea0235075f480d5

SHA512
070f6c7879ff7f7b31efa53ea47ff674025829a5bcd95662826f28b71628bd4dd870d3983ec393b1677ef913f98eae22fb7b7af45047a0166ead19ca90d507b1

Download Submit
memory/1252-59-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/1252-60-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/1252-64-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/1252-65-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4456-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4456-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4456-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4496-74-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-88-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-114-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-71-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-111-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-77-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-80-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-83-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-86-0x0000000000A30000-0x0000000000AD1000-memory.dmp

Filesize
644KB

Download
memory/4496-68-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-93-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-96-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-99-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-102-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-105-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4496-108-0x0000000000400000-0x0000000000745000-memory.dmp

Filesize
3.3MB

Download
memory/4724-13-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4724-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download