socks5systemz | 3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003

Analysis

max time kernel
141s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.exe
Size

5.3MB
MD5

e2208a56f9bb504de84a50d2bb17298a
SHA1

adad14bf80b4c1d4a80db9a5746dc3885a8251ab
SHA256

3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003
SHA512

eaa9f07ab2d2009d2fd15ef8d4ada645593a4599b8bbb17e6c1575d6142d6d59e0d72761b8ae42e3d060ce16e02f003270220c2b21fe37d66f2719057cc1b0d3
SSDEEP

98304:Cc2o88Wwdfjpqtzwnk60liEABnRIJ6mJBbDJc4yI5X3Pp5KYPxOZeZQxp:7Pdf6zwnk66mBnOJ6IBbC4yOxjJOZwQL

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3900-87-0x0000000000AF0000-0x0000000000B92000-memory.dmp	family_socks5systemz
behavioral2/memory/3900-111-0x0000000000AF0000-0x0000000000B92000-memory.dmp	family_socks5systemz
behavioral2/memory/3900-110-0x0000000000AF0000-0x0000000000B92000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmpmorphologyvixenjunior.exemorphologyvixenjunior.exe

pid process

4128 3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp
4920 morphologyvixenjunior.exe
3900 morphologyvixenjunior.exe
Loads dropped DLL 1 IoCs

Processes:

3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp

pid process

4128 3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 45.155.250.90
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp

pid process

4128 3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp

pid	process
4128	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp
4920	morphologyvixenjunior.exe
3900	morphologyvixenjunior.exe

pid	process
4128	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp

description	ioc
Destination IP	45.155.250.90

pid	process
4128	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.exe3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp

description	pid	process	target process
PID 1804 wrote to memory of 4128	1804	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.exe	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp
PID 1804 wrote to memory of 4128	1804	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.exe	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp
PID 1804 wrote to memory of 4128	1804	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.exe	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp
PID 4128 wrote to memory of 4920	4128	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp	morphologyvixenjunior.exe
PID 4128 wrote to memory of 4920	4128	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp	morphologyvixenjunior.exe
PID 4128 wrote to memory of 4920	4128	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp	morphologyvixenjunior.exe
PID 4128 wrote to memory of 3900	4128	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp	morphologyvixenjunior.exe
PID 4128 wrote to memory of 3900	4128	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp	morphologyvixenjunior.exe
PID 4128 wrote to memory of 3900	4128	3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp	morphologyvixenjunior.exe

C:\Users\Admin\AppData\Local\Temp\3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.exe
"C:\Users\Admin\AppData\Local\Temp\3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Local\Temp\is-TPUT5.tmp\3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp
"C:\Users\Admin\AppData\Local\Temp\is-TPUT5.tmp\3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp" /SL5="$B0050,5352588,54272,C:\Users\Admin\AppData\Local\Temp\3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4128

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe
"C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe" -i
3⤵
- Executes dropped EXE
PID:4920

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe
"C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe" -s
3⤵
- Executes dropped EXE
PID:3900

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe
Filesize
3.8MB

MD5
9216bb9bd04aca3b3dec939dbf4bc94f

SHA1
4bd35e276351a575974cbfbb4d69cec37623a960

SHA256
2e140187fd48eafa00476083d666a4615c8cd27d2e1273a857cefa6624b21478

SHA512
7fb0f22df7522e6d85cc200cca4d5bd7c684f4093429d446ed74d5a77e8feb53897bb5bd3ba9c2974bc8f391812da624511fc24704beaa198901997e7c03dac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ACJ0A.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TPUT5.tmp\3738510eb93b4637399210c75b9037955d44aa4ef61085e566e750d8e1a81003.tmp
Filesize
680KB

MD5
092d06ad9c403cf3352233aecf9a11ee

SHA1
6fb2ad5fa453795d2164b0d17e850fe075501578

SHA256
5e8caafbb00b0dbc480c3d0a0fd7541f8e861cae8d1ea60f86e52d2e92143a07

SHA512
30fbf8f0f4e6f60624793c3d2e242f3478e09071358bf86ebdf27c6846907d72feca83ddee3942fb5c021bd88150ada5137c6d80853b776fc4eedc6ec2cc9000

Download Submit
memory/1804-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1804-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1804-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3900-94-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-87-0x0000000000AF0000-0x0000000000B92000-memory.dmp

Filesize
648KB

Download
memory/3900-118-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-115-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-68-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-110-0x0000000000AF0000-0x0000000000B92000-memory.dmp

Filesize
648KB

Download
memory/3900-111-0x0000000000AF0000-0x0000000000B92000-memory.dmp

Filesize
648KB

Download
memory/3900-71-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-74-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-75-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-78-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-81-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-84-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-109-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-89-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-106-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-97-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-100-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/3900-103-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/4128-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4128-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4920-59-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/4920-60-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/4920-63-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download
memory/4920-65-0x0000000000400000-0x00000000007C4000-memory.dmp

Filesize
3.8MB

Download