socks5systemz | 3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d

Analysis

max time kernel
141s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.exe
Size

5.0MB
MD5

da865a85f3770bcc56f9957ca824050f
SHA1

79233d9f70c96a65f641771dbfffb93f9ffd9770
SHA256

3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d
SHA512

15eb7ab202abcf70df0fa632e16f23bd73b032c57d37fde33b1444c6a2a355aed041543605428e0a090ef528b4325e81fda9d3039185228c46bed1be55d05b50
SSDEEP

98304:CRBYatio/bCoFB6Cnf3ufG5ddakHSh1lqluH6nJ3fEWs+ISCgXRyWoQxx:G/NTCoXf3ufGndaZPH6FC+ISCgXEQn

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4396-86-0x0000000000B70000-0x0000000000C12000-memory.dmp family_socks5systemz
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmpmorphologyvixenjunior.exemorphologyvixenjunior.exe

pid process

4824 3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp
3584 morphologyvixenjunior.exe
4396 morphologyvixenjunior.exe
Loads dropped DLL 1 IoCs

Processes:

3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp

pid process

4824 3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 45.155.250.90
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp

pid process

4824 3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp

resource	yara_rule
behavioral2/memory/4396-86-0x0000000000B70000-0x0000000000C12000-memory.dmp	family_socks5systemz

pid	process
4824	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp
3584	morphologyvixenjunior.exe
4396	morphologyvixenjunior.exe

pid	process
4824	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp

description	ioc
Destination IP	45.155.250.90

pid	process
4824	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.exe3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp

description	pid	process	target process
PID 3580 wrote to memory of 4824	3580	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.exe	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp
PID 3580 wrote to memory of 4824	3580	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.exe	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp
PID 3580 wrote to memory of 4824	3580	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.exe	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp
PID 4824 wrote to memory of 3584	4824	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp	morphologyvixenjunior.exe
PID 4824 wrote to memory of 3584	4824	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp	morphologyvixenjunior.exe
PID 4824 wrote to memory of 3584	4824	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp	morphologyvixenjunior.exe
PID 4824 wrote to memory of 4396	4824	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp	morphologyvixenjunior.exe
PID 4824 wrote to memory of 4396	4824	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp	morphologyvixenjunior.exe
PID 4824 wrote to memory of 4396	4824	3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp	morphologyvixenjunior.exe

C:\Users\Admin\AppData\Local\Temp\3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.exe
"C:\Users\Admin\AppData\Local\Temp\3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3580

C:\Users\Admin\AppData\Local\Temp\is-O4ID2.tmp\3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp
"C:\Users\Admin\AppData\Local\Temp\is-O4ID2.tmp\3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp" /SL5="$40204,4941626,54272,C:\Users\Admin\AppData\Local\Temp\3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4824

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe
"C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe" -i
3⤵
- Executes dropped EXE
PID:3584

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe
"C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe" -s
3⤵
- Executes dropped EXE
PID:4396

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\morphologyvixenjunior.exe
Filesize
3.4MB

MD5
176f578c033156e3132f010114101d63

SHA1
8120e0b63fd0529938e954cd73b50eaa736837b7

SHA256
3833e3c66da052708d392ffd9a9b8fbbc77ed585095f83a851e98df54d70828c

SHA512
5cf2eb1d1c125cc44ec6a3613321e75848364a825035abef2bff46b62c5cc61c1c36ed1ffa0cf0b84c93427f27f9b4c6a3c3735210870f9aa4179e034c5f81a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LL6KF.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O4ID2.tmp\3f94a9b9420d34dbcbbfa0711be3c1db37cb36485579d6d2dfaf7b4f985f2b0d.tmp
Filesize
680KB

MD5
b6a17422b2e4483cbe595e6c3980118a

SHA1
b7465de463d9ea253a49c6bb5498cca7b311bf79

SHA256
0bbd2425ddcb117eb124ea7400613a1ef4f7b6e24c0d677d65327701fc85b883

SHA512
9fdacf5578564b0c1224ae59b6086c907c25408ba7f34d9c5571af47c53dfe53b77a303eb7e86f26b6e5806b1ebc2ab2f206941c0447702e9aada9360307df49

Download Submit
memory/3580-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3580-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3580-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3584-59-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3584-63-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3584-65-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/3584-60-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-74-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-86-0x0000000000B70000-0x0000000000C12000-memory.dmp

Filesize
648KB

Download
memory/4396-116-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-71-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-112-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-75-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-78-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-81-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-84-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-68-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-88-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-94-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-97-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-100-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-103-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-106-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4396-109-0x0000000000400000-0x0000000000762000-memory.dmp

Filesize
3.4MB

Download
memory/4824-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4824-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download