socks5systemz | fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
01-07-2024 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.exe
Size

5.5MB
MD5

6aacb63def4608e77d65101830fc3651
SHA1

cc185f7501213c22167edf4d9e45d832dff3d2b1
SHA256

fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb
SHA512

5571b91ecded8f8052bb13078b9fa0746dc659ea6b3eaa5ce382944025b65c130ea9d17a3a2a6e9781e157b419f9a065cc68b60f2b0372c18bbdad802e63f69f
SSDEEP

98304:CQstmqnObn9Y0O7MnUS8sIK6kc/M39Cpr7H2Pn8MEdTFKQ/6Qx7:CtmqnynWR7MnU2cUt68nhE8K6QV

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3700-86-0x0000000000AB0000-0x0000000000B52000-memory.dmp family_socks5systemz
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmpmp3doctorfree32.exemp3doctorfree32.exe

pid process

1796 fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp
3412 mp3doctorfree32.exe
3700 mp3doctorfree32.exe
Loads dropped DLL 1 IoCs

Processes:

fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp

pid process

1796 fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 91.211.247.248
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp

pid process

1796 fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp

resource	yara_rule
behavioral2/memory/3700-86-0x0000000000AB0000-0x0000000000B52000-memory.dmp	family_socks5systemz

pid	process
1796	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp
3412	mp3doctorfree32.exe
3700	mp3doctorfree32.exe

pid	process
1796	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp

description	ioc
Destination IP	91.211.247.248

pid	process
1796	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.exefc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp

description	pid	process	target process
PID 4712 wrote to memory of 1796	4712	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.exe	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp
PID 4712 wrote to memory of 1796	4712	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.exe	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp
PID 4712 wrote to memory of 1796	4712	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.exe	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp
PID 1796 wrote to memory of 3412	1796	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp	mp3doctorfree32.exe
PID 1796 wrote to memory of 3412	1796	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp	mp3doctorfree32.exe
PID 1796 wrote to memory of 3412	1796	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp	mp3doctorfree32.exe
PID 1796 wrote to memory of 3700	1796	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp	mp3doctorfree32.exe
PID 1796 wrote to memory of 3700	1796	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp	mp3doctorfree32.exe
PID 1796 wrote to memory of 3700	1796	fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp	mp3doctorfree32.exe

C:\Users\Admin\AppData\Local\Temp\fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.exe
"C:\Users\Admin\AppData\Local\Temp\fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4712

C:\Users\Admin\AppData\Local\Temp\is-ASDDO.tmp\fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp
"C:\Users\Admin\AppData\Local\Temp\is-ASDDO.tmp\fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp" /SL5="$60202,5487058,54272,C:\Users\Admin\AppData\Local\Temp\fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\MP3Doctor Free 2021\mp3doctorfree32.exe
"C:\Users\Admin\AppData\Local\MP3Doctor Free 2021\mp3doctorfree32.exe" -i
3⤵
- Executes dropped EXE
PID:3412

C:\Users\Admin\AppData\Local\MP3Doctor Free 2021\mp3doctorfree32.exe
"C:\Users\Admin\AppData\Local\MP3Doctor Free 2021\mp3doctorfree32.exe" -s
3⤵
- Executes dropped EXE
PID:3700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MP3Doctor Free 2021\mp3doctorfree32.exe
Filesize
3.5MB

MD5
b841059d56c0662b20c0697b28048917

SHA1
dd47ed1a4796da8eb382f9b465d289550e4a82f2

SHA256
5606a6e7e27f8821d8237a637d273cefacb7c51b9dbcbce05cb927d55c303a5d

SHA512
dc8d50e0f277041669ae96e9e50ed684469a9b9b6ca59d0dcdb9fd2b94c55c1c512ee1e13f8b9f41f153624cf365d573040589eee1d365972f31e0f6c6f78b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8D1L5.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ASDDO.tmp\fc9a89692a124f4f0353ac0caf60e3e67d0a5fb9fd7ec7e4cc8334083054acfb.tmp
Filesize
680KB

MD5
f2c590a5984e17e207ae3170ad207b55

SHA1
213e360c8d168c3c6e0e0ffb071e1d8b04bcb815

SHA256
bde90135e9cd6e66c996b468bbd498f87c5b3fe08537b4cf81943de0c00e51aa

SHA512
7754dfeb1102dc165383ce36aaa39d0c6ea99502d8ec3decb33f7c124602796f2e5daa4ef2c6153fe250d75e3d5d399b0cf90376f5e5520211c5dc6275d6ad77

Download Submit
memory/1796-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1796-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3412-65-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3412-59-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3412-63-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3412-60-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-74-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-98-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-116-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-113-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-71-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-110-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-75-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-78-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-81-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-84-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-86-0x0000000000AB0000-0x0000000000B52000-memory.dmp

Filesize
648KB

Download
memory/3700-90-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-95-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-68-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-101-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-104-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/3700-107-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/4712-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4712-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4712-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download