socks5systemz | c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7

Analysis

max time kernel
143s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.exe
Size

5.1MB
MD5

9e9f38c391a772eb98a05b9104d94d9a
SHA1

94023dbe26283bee8d9fce76ea58bb9ec1c1c005
SHA256

c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7
SHA512

c759a67613eef45799883279cb6980d89d251857f926072f6683389339a0283322205da9e7eceff0fbbe296bed2e921685fc01b04dc6511c25b2021084bafd9e
SSDEEP

98304:CcpzLSwvwAIwNMWN+ooO/bqRFvvoeTlj7kqzGqUsrQxXa:fzuwvjBNTuEKljfzGeQ9a

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5000-88-0x0000000000A30000-0x0000000000AD2000-memory.dmp	family_socks5systemz
behavioral1/memory/5000-111-0x0000000000A30000-0x0000000000AD2000-memory.dmp	family_socks5systemz
behavioral1/memory/5000-112-0x0000000000A30000-0x0000000000AD2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmpvkfreeaudiosaver32_64.exevkfreeaudiosaver32_64.exe

pid process

3484 c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp
4376 vkfreeaudiosaver32_64.exe
5000 vkfreeaudiosaver32_64.exe
Loads dropped DLL 1 IoCs

Processes:

c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp

pid process

3484 c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 141.98.234.31
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp

pid process

3484 c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp

pid	process
3484	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp
4376	vkfreeaudiosaver32_64.exe
5000	vkfreeaudiosaver32_64.exe

pid	process
3484	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp

description	ioc
Destination IP	141.98.234.31

pid	process
3484	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.exec125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp

description	pid	process	target process
PID 212 wrote to memory of 3484	212	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.exe	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp
PID 212 wrote to memory of 3484	212	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.exe	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp
PID 212 wrote to memory of 3484	212	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.exe	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp
PID 3484 wrote to memory of 4376	3484	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp	vkfreeaudiosaver32_64.exe
PID 3484 wrote to memory of 4376	3484	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp	vkfreeaudiosaver32_64.exe
PID 3484 wrote to memory of 4376	3484	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp	vkfreeaudiosaver32_64.exe
PID 3484 wrote to memory of 5000	3484	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp	vkfreeaudiosaver32_64.exe
PID 3484 wrote to memory of 5000	3484	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp	vkfreeaudiosaver32_64.exe
PID 3484 wrote to memory of 5000	3484	c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp	vkfreeaudiosaver32_64.exe

C:\Users\Admin\AppData\Local\Temp\c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.exe
"C:\Users\Admin\AppData\Local\Temp\c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:212

C:\Users\Admin\AppData\Local\Temp\is-C9522.tmp\c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp
"C:\Users\Admin\AppData\Local\Temp\is-C9522.tmp\c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp" /SL5="$601D6,5133764,54272,C:\Users\Admin\AppData\Local\Temp\c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3484

C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe
"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe" -i
3⤵
- Executes dropped EXE
PID:4376

C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe
"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe" -s
3⤵
- Executes dropped EXE
PID:5000

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-C2IA1.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C9522.tmp\c125f12d91e6870322ef19684c54f9a0d21d9ebd0f9a1e626b309d3e3ae54de7.tmp
Filesize
680KB

MD5
b1397898451beea2b4e9acc92d855238

SHA1
8260c2c26f3f098dd7aac48262f11fae87f7bf6b

SHA256
d0223e1d0f72ea52b3bae90c6e212fd967af81b6a82fb6f87908e4ba5685409f

SHA512
60432f96c9a81b95dfe541a08419ffc3f1dcbb2a16bbb129b63e332abe93fdb4076dfe9223eee70aa8a46dc277e1990612e821fe00c389bea0d90bf25d4b800b

Download Submit
C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe
Filesize
3.7MB

MD5
89e96572239a65440fccb3f7e786b53e

SHA1
8747ad3bea7774f91a5ea54e73b9b8e7ab9f8866

SHA256
400c73158cdba66dbd7becee71f13fbaacd96a1bfe9a396fbf8ca202eb2a3143

SHA512
5006fd6e938552990bd493431d34ed512181b5c6de8f45243f53d014c518f8e26177fe78cb166379e993e352cab8c01277206246c7eae00d69bb1c04d21865fa

Download Submit
memory/212-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/212-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/212-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3484-12-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3484-71-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4376-59-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/4376-60-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/4376-65-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/4376-64-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-76-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-92-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-72-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-75-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-67-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-79-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-82-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-85-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-88-0x0000000000A30000-0x0000000000AD2000-memory.dmp

Filesize
648KB

Download
memory/5000-69-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-95-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-98-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-101-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-104-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-107-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-110-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-111-0x0000000000A30000-0x0000000000AD2000-memory.dmp

Filesize
648KB

Download
memory/5000-112-0x0000000000A30000-0x0000000000AD2000-memory.dmp

Filesize
648KB

Download
memory/5000-116-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download
memory/5000-119-0x0000000000400000-0x00000000007AF000-memory.dmp

Filesize
3.7MB

Download