Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a

  • Size

    5.0MB

  • Sample

    240630-g78mnsvamg

  • MD5

    56dadd1027257ec9188fe8e5f5adfc6b

  • SHA1

    71b85d3373d46edb91ec45e0f0b4be3f7f717aa3

  • SHA256

    ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a

  • SHA512

    19e998f857947c9c1f78cad64d02150a1df76c1aec4534b65911d09c290613ad699fa2f9fd5b03fcba632738834238bc0d816b152eb2812ac951ba6e42b4b92f

  • SSDEEP

    98304:CbmM3YdCiIVaaR/iEG4GLXwjiR/Mrl4/H8iYZQxp:OmM/iIVviErcXwrl+cdZQL

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a

    • Size

      5.0MB

    • MD5

      56dadd1027257ec9188fe8e5f5adfc6b

    • SHA1

      71b85d3373d46edb91ec45e0f0b4be3f7f717aa3

    • SHA256

      ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a

    • SHA512

      19e998f857947c9c1f78cad64d02150a1df76c1aec4534b65911d09c290613ad699fa2f9fd5b03fcba632738834238bc0d816b152eb2812ac951ba6e42b4b92f

    • SSDEEP

      98304:CbmM3YdCiIVaaR/iEG4GLXwjiR/Mrl4/H8iYZQxp:OmM/iIVviErcXwrl+cdZQL

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks