socks5systemz | 42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
29-06-2024 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.exe
Size

5.0MB
MD5

9bce1e8b20d486989240f892d818421e
SHA1

aae834e9eb3b2b92fee64cc9e8132a070ac23cb2
SHA256

42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5
SHA512

cb781bd7722813be483e927990eae9c07a899106566cbb7455a5139cd8934073cfd13c3c68da7cf00ab2e62025a3066ebf218e5043242e4ac4452fc5f0939448
SSDEEP

98304:Che1J5MVCvdr/ye4bTUQhFsXH6AopxOlBQFLfVxLNYtU/cwq7D8dQxY:qQeUby7oKsXTonskRxZSSi7D8dQC

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/572-87-0x0000000000A90000-0x0000000000B31000-memory.dmp	family_socks5systemz
behavioral2/memory/572-110-0x0000000000A90000-0x0000000000B31000-memory.dmp	family_socks5systemz
behavioral2/memory/572-111-0x0000000000A90000-0x0000000000B31000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmpvkfreeaudiosaver32.exevkfreeaudiosaver32.exe

pid process

5056 42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp
4896 vkfreeaudiosaver32.exe
572 vkfreeaudiosaver32.exe
Loads dropped DLL 1 IoCs

Processes:

42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp

pid process

5056 42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 45.155.250.90
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp

pid process

5056 42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp

pid	process
5056	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp
4896	vkfreeaudiosaver32.exe
572	vkfreeaudiosaver32.exe

pid	process
5056	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp

description	ioc
Destination IP	45.155.250.90

pid	process
5056	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.exe42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp

description	pid	process	target process
PID 1228 wrote to memory of 5056	1228	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.exe	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp
PID 1228 wrote to memory of 5056	1228	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.exe	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp
PID 1228 wrote to memory of 5056	1228	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.exe	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp
PID 5056 wrote to memory of 4896	5056	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp	vkfreeaudiosaver32.exe
PID 5056 wrote to memory of 4896	5056	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp	vkfreeaudiosaver32.exe
PID 5056 wrote to memory of 4896	5056	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp	vkfreeaudiosaver32.exe
PID 5056 wrote to memory of 572	5056	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp	vkfreeaudiosaver32.exe
PID 5056 wrote to memory of 572	5056	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp	vkfreeaudiosaver32.exe
PID 5056 wrote to memory of 572	5056	42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp	vkfreeaudiosaver32.exe

C:\Users\Admin\AppData\Local\Temp\42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.exe
"C:\Users\Admin\AppData\Local\Temp\42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\is-PQL95.tmp\42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp
"C:\Users\Admin\AppData\Local\Temp\is-PQL95.tmp\42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp" /SL5="$50068,5001016,54272,C:\Users\Admin\AppData\Local\Temp\42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5056

C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32.exe
"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32.exe" -i
3⤵
- Executes dropped EXE
PID:4896

C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32.exe
"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32.exe" -s
3⤵
- Executes dropped EXE
PID:572

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-7DDKI.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PQL95.tmp\42546a61d6d80e4d1a171f4a08fae2ecd12138ad939280fafed39f717b0de2f5.tmp
Filesize
680KB

MD5
31afd676fdf62a3ee6a499837ea0ffef

SHA1
9a014771b713474cd787cd20857b79b6cdf236c3

SHA256
ed615763544059955ebae2a355a1ecca2bba3af561c82b274ee86b303d52a292

SHA512
ca9e0d6d3f174027aeafa15a2b7e3642c8e5208d69dd7cafb5d5e841298973503a1e53226ae3df7e2e2601b574da55dde16bcc93b22101710060876b248979b3

Download Submit
C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32.exe
Filesize
3.3MB

MD5
1176ff705ec86130f8d2039bdef0e8a4

SHA1
86ffc830593a39720a34c9ff363b856b369cefad

SHA256
0a34d1b8d8af124089a22ba22d33966650fa715003ffad09d33f24dceeab55ad

SHA512
6770e97d6f0c34d17da2a217ebe1161121d2413dafa10b42b99ab555a610e3852563c33cffbb5248560d374b8f9976bab5b451d339a4b3cf04dd8fbda2f23356

Download Submit
memory/572-94-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-78-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-118-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-115-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-111-0x0000000000A90000-0x0000000000B31000-memory.dmp

Filesize
644KB

Download
memory/572-110-0x0000000000A90000-0x0000000000B31000-memory.dmp

Filesize
644KB

Download
memory/572-67-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-68-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-109-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-106-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-71-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-74-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-75-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-103-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-81-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-84-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-87-0x0000000000A90000-0x0000000000B31000-memory.dmp

Filesize
644KB

Download
memory/572-88-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-100-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/572-97-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/1228-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1228-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1228-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4896-62-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/4896-63-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/4896-59-0x0000000000400000-0x0000000000751000-memory.dmp

Filesize
3.3MB

Download
memory/5056-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/5056-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download