socks5systemz | 218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.exe
Size

5.0MB
MD5

7b6340fca5336f26e1b60a7a27f6009c
SHA1

3269704d43a3b6a2731962d06bcb17c3631fed45
SHA256

218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075
SHA512

3078fe8a10623aceb7cc60a88d6767423702f41e3f401f5a1f29ed9e178fee7378e15de7215c0d83d2a32da67b258e5f6566f1c149d6a2eafd6e024a2320b27e
SSDEEP

98304:CUN8Zpuee1Kg6O2cNnsk+6kgaoxqCk8jvVf28ufKmpceWvGFpfdkQxt:eZp9UKFO2c1sk+6kgNG8RepfKmpcesGl

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/1548-86-0x0000000000900000-0x00000000009A2000-memory.dmp family_socks5systemz
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmpmp3doctorfree.exemp3doctorfree.exe

pid process

1436 218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp
4932 mp3doctorfree.exe
1548 mp3doctorfree.exe
Loads dropped DLL 1 IoCs

Processes:

218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp

pid process

1436 218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 141.98.234.31
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp

pid process

1436 218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp

resource	yara_rule
behavioral1/memory/1548-86-0x0000000000900000-0x00000000009A2000-memory.dmp	family_socks5systemz

pid	process
1436	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp
4932	mp3doctorfree.exe
1548	mp3doctorfree.exe

pid	process
1436	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp

description	ioc
Destination IP	141.98.234.31

pid	process
1436	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.exe218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp

description	pid	process	target process
PID 4864 wrote to memory of 1436	4864	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.exe	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp
PID 4864 wrote to memory of 1436	4864	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.exe	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp
PID 4864 wrote to memory of 1436	4864	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.exe	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp
PID 1436 wrote to memory of 4932	1436	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp	mp3doctorfree.exe
PID 1436 wrote to memory of 4932	1436	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp	mp3doctorfree.exe
PID 1436 wrote to memory of 4932	1436	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp	mp3doctorfree.exe
PID 1436 wrote to memory of 1548	1436	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp	mp3doctorfree.exe
PID 1436 wrote to memory of 1548	1436	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp	mp3doctorfree.exe
PID 1436 wrote to memory of 1548	1436	218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp	mp3doctorfree.exe

C:\Users\Admin\AppData\Local\Temp\218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.exe
"C:\Users\Admin\AppData\Local\Temp\218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4864

C:\Users\Admin\AppData\Local\Temp\is-93K30.tmp\218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp
"C:\Users\Admin\AppData\Local\Temp\is-93K30.tmp\218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp" /SL5="$7011E,4970203,54272,C:\Users\Admin\AppData\Local\Temp\218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1436

C:\Users\Admin\AppData\Local\MP3Doctor Free 2022\mp3doctorfree.exe
"C:\Users\Admin\AppData\Local\MP3Doctor Free 2022\mp3doctorfree.exe" -i
3⤵
- Executes dropped EXE
PID:4932

C:\Users\Admin\AppData\Local\MP3Doctor Free 2022\mp3doctorfree.exe
"C:\Users\Admin\AppData\Local\MP3Doctor Free 2022\mp3doctorfree.exe" -s
3⤵
- Executes dropped EXE
PID:1548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MP3Doctor Free 2022\mp3doctorfree.exe
Filesize
3.5MB

MD5
348ae2f136f115db6d8bae7b7c41db0e

SHA1
6668b306456d96bb881bec122514b0562472c5a1

SHA256
5cf7739cbb3282edad1c5e5cb5b0168f6892ae6f8a9479874af2a3aa0996500a

SHA512
e47764adbf622be9d86d8b89d945cab290ac82dd04b4d15dda27f0f9cfcd66837aa814db7655b7a83612d540a73258a399a1effd8b79c51e77a692e673d4783a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5SKI8.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-93K30.tmp\218b2c7473967f841172dc94bec34fc9c38b01b9d9f6b88b5ab45de576d85075.tmp
Filesize
680KB

MD5
7ac975436d199406bad846a844a9c8b0

SHA1
828a73cd635f2b7c3fe50a25808f26f59994af11

SHA256
fa041fed23876105c5b2e4c2225950508f43d6875dd318d9208e7aa01525831d

SHA512
5d2d2ff3097f2c69d4e207f77e7eabeab0685a24eff96548755c1620ba63ec2a119c4b9f9222da811390595ba893ab71d7e3966c4f149074465fc16dbf8b0ef0

Download Submit
memory/1436-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1436-13-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1548-94-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-74-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-116-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-113-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-109-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-68-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-106-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-103-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-71-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-97-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-75-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-78-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-81-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-84-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-86-0x0000000000900000-0x00000000009A2000-memory.dmp

Filesize
648KB

Download
memory/1548-89-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/1548-100-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/4864-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4864-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4864-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4932-59-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/4932-65-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/4932-63-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/4932-60-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download