Overview

overview

10

Static

static

3

2e2d0faa0b...cs.exe

windows7-x64

10

2e2d0faa0b...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e2d0faa0bd89ea7ee56c0193350d98941bbe99f3eac35424bbfee5c24305e65_NeikiAnalytics.exe

  • Size

    5.0MB

  • Sample

    240701-cre8zatamf

  • MD5

    5c66b886beefc9589ed9db5e15cf0780

  • SHA1

    8b79be9b191a812131ffc663341c6dc549d15899

  • SHA256

    2e2d0faa0bd89ea7ee56c0193350d98941bbe99f3eac35424bbfee5c24305e65

  • SHA512

    4e7401bd22fc006ae1ba19cd704ed27e2905f983ecd45564394123876e053881e44a9125d1a2e84bd77401238dea4866983743de93b8be4b7171b8d56ab6f35f

  • SSDEEP

    98304:mhu+9xGgU8AJ+fjOwgC30JuQszCRyOzoNDkhzowGLT9WOvMePQDv/aId:Wu+TjSAjONQBOsNohUwm9lvMgq/aId

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Extracted

Family

socks5systemz

C2

ezdixir.ua

aipqgda.ru

Targets

    • Target

      2e2d0faa0bd89ea7ee56c0193350d98941bbe99f3eac35424bbfee5c24305e65_NeikiAnalytics.exe

    • Size

      5.0MB

    • MD5

      5c66b886beefc9589ed9db5e15cf0780

    • SHA1

      8b79be9b191a812131ffc663341c6dc549d15899

    • SHA256

      2e2d0faa0bd89ea7ee56c0193350d98941bbe99f3eac35424bbfee5c24305e65

    • SHA512

      4e7401bd22fc006ae1ba19cd704ed27e2905f983ecd45564394123876e053881e44a9125d1a2e84bd77401238dea4866983743de93b8be4b7171b8d56ab6f35f

    • SSDEEP

      98304:mhu+9xGgU8AJ+fjOwgC30JuQszCRyOzoNDkhzowGLT9WOvMePQDv/aId:Wu+TjSAjONQBOsNohUwm9lvMgq/aId

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks