Overview

overview

10

Static

static

3

112fabc0aa...fa.exe

windows7-x64

10

112fabc0aa...fa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    112fabc0aae6f0be68ca31f4acc53afa.exe

  • Size

    4.5MB

  • Sample

    240701-gekp5s1cmj

  • MD5

    112fabc0aae6f0be68ca31f4acc53afa

  • SHA1

    e9f97d439abf459cdf7877ae4e61f1e2af934834

  • SHA256

    a8aba4eea6ee777d808da1c3c6a7cd83ca9b7c10c451fdaa30e5c8ec966c3e06

  • SHA512

    2ed1aed32004fe8251a7f37d2bcaa0011505cbbd8f41577c0ebe621f583ddfac60ff55f75bd9881b6b69189346904f147692d5ea714112d8618059ee6fe63d5f

  • SSDEEP

    98304:CC/Gs7cpyygvvmx0y/Bu5pQOCsaY5WQb77sQ7Jg532miynC8SiQx2:l/zcpyygv+xV0SsWA7ZFgbzUiQw

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      112fabc0aae6f0be68ca31f4acc53afa.exe

    • Size

      4.5MB

    • MD5

      112fabc0aae6f0be68ca31f4acc53afa

    • SHA1

      e9f97d439abf459cdf7877ae4e61f1e2af934834

    • SHA256

      a8aba4eea6ee777d808da1c3c6a7cd83ca9b7c10c451fdaa30e5c8ec966c3e06

    • SHA512

      2ed1aed32004fe8251a7f37d2bcaa0011505cbbd8f41577c0ebe621f583ddfac60ff55f75bd9881b6b69189346904f147692d5ea714112d8618059ee6fe63d5f

    • SSDEEP

      98304:CC/Gs7cpyygvvmx0y/Bu5pQOCsaY5WQb77sQ7Jg532miynC8SiQx2:l/zcpyygv+xV0SsWA7ZFgbzUiQw

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks