socks5systemz | ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a

Analysis

max time kernel
147s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.exe
Size

5.0MB
MD5

56dadd1027257ec9188fe8e5f5adfc6b
SHA1

71b85d3373d46edb91ec45e0f0b4be3f7f717aa3
SHA256

ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a
SHA512

19e998f857947c9c1f78cad64d02150a1df76c1aec4534b65911d09c290613ad699fa2f9fd5b03fcba632738834238bc0d816b152eb2812ac951ba6e42b4b92f
SSDEEP

98304:CbmM3YdCiIVaaR/iEG4GLXwjiR/Mrl4/H8iYZQxp:OmM/iIVviErcXwrl+cdZQL

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3864-88-0x0000000000AB0000-0x0000000000B52000-memory.dmp family_socks5systemz
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmpmorphologyvixenjunior.exemorphologyvixenjunior.exe

pid process

4876 ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp
1076 morphologyvixenjunior.exe
3864 morphologyvixenjunior.exe
Loads dropped DLL 1 IoCs

Processes:

ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp

pid process

4876 ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 141.98.234.31
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp

pid process

4876 ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp

resource	yara_rule
behavioral2/memory/3864-88-0x0000000000AB0000-0x0000000000B52000-memory.dmp	family_socks5systemz

pid	process
4876	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp
1076	morphologyvixenjunior.exe
3864	morphologyvixenjunior.exe

pid	process
4876	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp

description	ioc
Destination IP	141.98.234.31

pid	process
4876	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.exeecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp

description	pid	process	target process
PID 4576 wrote to memory of 4876	4576	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.exe	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp
PID 4576 wrote to memory of 4876	4576	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.exe	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp
PID 4576 wrote to memory of 4876	4576	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.exe	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp
PID 4876 wrote to memory of 1076	4876	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp	morphologyvixenjunior.exe
PID 4876 wrote to memory of 1076	4876	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp	morphologyvixenjunior.exe
PID 4876 wrote to memory of 1076	4876	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp	morphologyvixenjunior.exe
PID 4876 wrote to memory of 3864	4876	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp	morphologyvixenjunior.exe
PID 4876 wrote to memory of 3864	4876	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp	morphologyvixenjunior.exe
PID 4876 wrote to memory of 3864	4876	ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp	morphologyvixenjunior.exe

C:\Users\Admin\AppData\Local\Temp\ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.exe
"C:\Users\Admin\AppData\Local\Temp\ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4576

C:\Users\Admin\AppData\Local\Temp\is-HRN6E.tmp\ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HRN6E.tmp\ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp" /SL5="$80104,4992628,54272,C:\Users\Admin\AppData\Local\Temp\ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4876

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe
"C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe" -i
3⤵
- Executes dropped EXE
PID:1076

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe
"C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe" -s
3⤵
- Executes dropped EXE
PID:3864

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe
Filesize
3.4MB

MD5
3ad0520a5cf46da812245363ffcdf665

SHA1
b41c98911abcd74610dc03d020201304c0d49487

SHA256
23b494c6188511b6b0143a1e3a4bcce5ce777c7a991c423b260b178eda536a62

SHA512
ff900447a7f092aa5cedc2d1d3f8f0f54be34511281180d8c082d23206ce943ad2010fcddc01adc298904400fe68c9dca992e23f245d593a7a7dd6fb94dc9ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HRN6E.tmp\ecf5c7fb44073789ab432b9f17ac105f8df9efd99b6c47b2c564fa6e40cfda7a.tmp
Filesize
680KB

MD5
092d06ad9c403cf3352233aecf9a11ee

SHA1
6fb2ad5fa453795d2164b0d17e850fe075501578

SHA256
5e8caafbb00b0dbc480c3d0a0fd7541f8e861cae8d1ea60f86e52d2e92143a07

SHA512
30fbf8f0f4e6f60624793c3d2e242f3478e09071358bf86ebdf27c6846907d72feca83ddee3942fb5c021bd88150ada5137c6d80853b776fc4eedc6ec2cc9000

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UIJHL.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/1076-60-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/1076-65-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/1076-64-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/1076-59-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-72-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-99-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-118-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-67-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-69-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-115-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-111-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-108-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-75-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-76-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-79-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-82-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-85-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-88-0x0000000000AB0000-0x0000000000B52000-memory.dmp

Filesize
648KB

Download
memory/3864-91-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-96-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-105-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3864-102-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4576-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4576-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4576-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4876-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4876-71-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download