Overview

overview

10

Static

static

3

51270c6b72...cs.exe

windows7-x64

10

51270c6b72...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51270c6b728cf1f1c9ded5de0d2e3b70f0807b5f0b2beae4b770accd482da3fe_NeikiAnalytics.exe

  • Size

    5.1MB

  • Sample

    240701-pbtgwa1bpa

  • MD5

    4f0af713f662da73735c30b2031cd880

  • SHA1

    dccc8f113c2cf046d94bf6bcec606a9ee36f2b47

  • SHA256

    51270c6b728cf1f1c9ded5de0d2e3b70f0807b5f0b2beae4b770accd482da3fe

  • SHA512

    87f5cccaed9a4008dc5457fdb9e5b08fae7fcb701969dd539de4f7dde7716ab1bad2767c290161540af84a7a96c5947dc7c048dee200ba42e5d923ffec1487c4

  • SSDEEP

    98304:mjCNxofRUpItT8jckQH5Qn7ifeeB/vy15aM6pAf+p/OI:JfoZ7F/keq2V9y15ajAf+p/T

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Extracted

Family

socks5systemz

C2

bmclmzk.com

http://bmclmzk.com/search/?q=67e28dd83955a42b4006aa1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f671ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6e86fc17c5e890

http://bmclmzk.com/search/?q=67e28dd83955a42b4006aa1b7c27d78406abdd88be4b12eab517aa5c96bd86ea97864c96148ab2865b77f80ebad9c60f7cb63037ed2ab423a4334383ba915d911ec07bb606a0708720fa11b861c353baf51aba1e7242fa7023cc366689fe18c8ec939f3cc8

bhjexny.com

http://bhjexny.com/search/?q=67e28dd83f5aa4794209ff1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff619c3e892993b

http://bhjexny.com/search/?q=67e28dd83f5aa4794209ff1c7c27d78406abdd88be4b12eab517aa5c96bd86ee92854c825a8bbc896c58e713bc90c91d36b5281fc235a925ed3e01d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9c9238ca689516

Targets

    • Target

      51270c6b728cf1f1c9ded5de0d2e3b70f0807b5f0b2beae4b770accd482da3fe_NeikiAnalytics.exe

    • Size

      5.1MB

    • MD5

      4f0af713f662da73735c30b2031cd880

    • SHA1

      dccc8f113c2cf046d94bf6bcec606a9ee36f2b47

    • SHA256

      51270c6b728cf1f1c9ded5de0d2e3b70f0807b5f0b2beae4b770accd482da3fe

    • SHA512

      87f5cccaed9a4008dc5457fdb9e5b08fae7fcb701969dd539de4f7dde7716ab1bad2767c290161540af84a7a96c5947dc7c048dee200ba42e5d923ffec1487c4

    • SSDEEP

      98304:mjCNxofRUpItT8jckQH5Qn7ifeeB/vy15aM6pAf+p/OI:JfoZ7F/keq2V9y15ajAf+p/T

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks