socks5systemz | 5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.exe
Size

5.0MB
MD5

9607296e62c05b9281a6bdc81ccb9099
SHA1

6701d7ecd5d3b1e3ddd90122c7796e2ef7dd202f
SHA256

5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c
SHA512

23bb88bd663570e3335139d61cbb6f1603d4bfa2a63c7454bf1ce31e11d626180757c35524473ed87063523a116affe4b811cfe4ab23176724a7cbc571ddc027
SSDEEP

98304:Clbjm1dKyldp2o8S/RWFSxL59pu3RCZ+kFqWSE6F+nkXzlqAav+7uGiv5DzvdqQ4:vqFSxL3qoZ+h/F+kNavkMFdqQ9a

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/3828-88-0x00000000009D0000-0x0000000000A72000-memory.dmp family_socks5systemz
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmpvkfreeaudiosaver32_64.exevkfreeaudiosaver32_64.exe

pid process

4440 5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp
3832 vkfreeaudiosaver32_64.exe
3828 vkfreeaudiosaver32_64.exe
Loads dropped DLL 1 IoCs

Processes:

5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp

pid process

4440 5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 91.211.247.248
Destination IP 152.89.198.214
Destination IP 45.155.250.90
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp

pid process

4440 5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp

resource	yara_rule
behavioral1/memory/3828-88-0x00000000009D0000-0x0000000000A72000-memory.dmp	family_socks5systemz

pid	process
4440	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp
3832	vkfreeaudiosaver32_64.exe
3828	vkfreeaudiosaver32_64.exe

pid	process
4440	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp

description	ioc
Destination IP	91.211.247.248
Destination IP	152.89.198.214
Destination IP	45.155.250.90

pid	process
4440	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.exe5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp

description	pid	process	target process
PID 4708 wrote to memory of 4440	4708	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.exe	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp
PID 4708 wrote to memory of 4440	4708	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.exe	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp
PID 4708 wrote to memory of 4440	4708	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.exe	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp
PID 4440 wrote to memory of 3832	4440	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp	vkfreeaudiosaver32_64.exe
PID 4440 wrote to memory of 3832	4440	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp	vkfreeaudiosaver32_64.exe
PID 4440 wrote to memory of 3832	4440	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp	vkfreeaudiosaver32_64.exe
PID 4440 wrote to memory of 3828	4440	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp	vkfreeaudiosaver32_64.exe
PID 4440 wrote to memory of 3828	4440	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp	vkfreeaudiosaver32_64.exe
PID 4440 wrote to memory of 3828	4440	5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp	vkfreeaudiosaver32_64.exe

C:\Users\Admin\AppData\Local\Temp\5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.exe
"C:\Users\Admin\AppData\Local\Temp\5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708

C:\Users\Admin\AppData\Local\Temp\is-1A6Q6.tmp\5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp
"C:\Users\Admin\AppData\Local\Temp\is-1A6Q6.tmp\5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp" /SL5="$501F0,4991415,54272,C:\Users\Admin\AppData\Local\Temp\5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4440

C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe
"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe" -i
3⤵
- Executes dropped EXE
PID:3832

C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe
"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe" -s
3⤵
- Executes dropped EXE
PID:3828

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-1A6Q6.tmp\5f503b2fb90fa157628cdf3e17855b2c9c14379e04d974b84548892e7a718f2c.tmp
Filesize
680KB

MD5
b1397898451beea2b4e9acc92d855238

SHA1
8260c2c26f3f098dd7aac48262f11fae87f7bf6b

SHA256
d0223e1d0f72ea52b3bae90c6e212fd967af81b6a82fb6f87908e4ba5685409f

SHA512
60432f96c9a81b95dfe541a08419ffc3f1dcbb2a16bbb129b63e332abe93fdb4076dfe9223eee70aa8a46dc277e1990612e821fe00c389bea0d90bf25d4b800b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E5BDE.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe
Filesize
3.5MB

MD5
0dbe8174fc659901e32d4b7ae4ef0a65

SHA1
8516ee0ce55f6215ae8519dec5f093e1ebf727e9

SHA256
b27baa1549bbc1c2331f3d4bc40dd59ac3a843d7619abd90b896870a43a4fe54

SHA512
c491f0f910be0661eb23340776df4f83888cfb3b761902c3327b6532492722c593c848d9154a59884071ed2f87290e9c45df59f3d5c46776d2f68cce77e7e7c1

Download Submit
memory/3828-90-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-95-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-116-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-113-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-110-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-107-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-67-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-104-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-69-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-101-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-98-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-72-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-75-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-76-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-79-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-82-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-85-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3828-88-0x00000000009D0000-0x0000000000A72000-memory.dmp

Filesize
648KB

Download
memory/3832-60-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3832-65-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3832-63-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3832-59-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/4440-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4440-71-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4708-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4708-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4708-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download