socks5systemz | 9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63

Analysis

max time kernel
147s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
01-07-2024 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.exe
Size

5.2MB
MD5

f2322521df10cc628412e6e38c796dda
SHA1

7b9b2b61dc5659acb0eb57bc95d1e92986b67788
SHA256

9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63
SHA512

6ff1a00e28bd6ee45a0708071c7fd6cd9ac0efa9eeb289079263a4449a24453ceb08396643bd0f3aa5d0a2e32e656b5975a83e899a46d01433cf5cc51d5fe7cd
SSDEEP

98304:C6WrdJufsWCaZmgLCNepa+o0XvMpJ/FiaEwnBHQQ0+UD/XlP7uty46Wk53pKQxy:urdJufs5ImqMAfspF5nBw71uty46Wkc1

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4528-86-0x00000000029C0000-0x0000000002A62000-memory.dmp family_socks5systemz
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmpmp3doctorfree32_64.exemp3doctorfree32_64.exe

pid process

2240 9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp
1308 mp3doctorfree32_64.exe
4528 mp3doctorfree32_64.exe
Loads dropped DLL 1 IoCs

Processes:

9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp

pid process

2240 9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 91.211.247.248
Destination IP 152.89.198.214
Destination IP 91.211.247.248
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp

pid process

2240 9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp

resource	yara_rule
behavioral2/memory/4528-86-0x00000000029C0000-0x0000000002A62000-memory.dmp	family_socks5systemz

pid	process
2240	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp
1308	mp3doctorfree32_64.exe
4528	mp3doctorfree32_64.exe

pid	process
2240	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp

description	ioc
Destination IP	91.211.247.248
Destination IP	152.89.198.214
Destination IP	91.211.247.248

pid	process
2240	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.exe9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp

description	pid	process	target process
PID 1620 wrote to memory of 2240	1620	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.exe	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp
PID 1620 wrote to memory of 2240	1620	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.exe	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp
PID 1620 wrote to memory of 2240	1620	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.exe	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp
PID 2240 wrote to memory of 1308	2240	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp	mp3doctorfree32_64.exe
PID 2240 wrote to memory of 1308	2240	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp	mp3doctorfree32_64.exe
PID 2240 wrote to memory of 1308	2240	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp	mp3doctorfree32_64.exe
PID 2240 wrote to memory of 4528	2240	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp	mp3doctorfree32_64.exe
PID 2240 wrote to memory of 4528	2240	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp	mp3doctorfree32_64.exe
PID 2240 wrote to memory of 4528	2240	9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp	mp3doctorfree32_64.exe

C:\Users\Admin\AppData\Local\Temp\9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.exe
"C:\Users\Admin\AppData\Local\Temp\9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Users\Admin\AppData\Local\Temp\is-FHVS9.tmp\9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp
"C:\Users\Admin\AppData\Local\Temp\is-FHVS9.tmp\9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp" /SL5="$5020E,5226954,54272,C:\Users\Admin\AppData\Local\Temp\9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2240

C:\Users\Admin\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe
"C:\Users\Admin\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe" -i
3⤵
- Executes dropped EXE
PID:1308

C:\Users\Admin\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe
"C:\Users\Admin\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe" -s
3⤵
- Executes dropped EXE
PID:4528

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MP3Doctor Free 2020\mp3doctorfree32_64.exe
Filesize
3.9MB

MD5
2498b26779e87e5f8d506f95017410d9

SHA1
b8289299b98584b7156926abae1e929f477ba688

SHA256
59a383b4e16b85e14a61f9e93846fbbeb40c66a4c058d2c8af5d5505afe8a8a6

SHA512
127bd4bc8c3bb4dc77e34dbed593bed0fa58b43a9ba1bc3d467b31d77675fdf868767757e39a619f125d670ae28c7b80d75b9335c0244a1c894ec40f9f3591be

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DUG3T.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FHVS9.tmp\9808985250425d6775a23a4a8bfd7b1b483d85594c2197cd52d72dc3d7030a63.tmp
Filesize
680KB

MD5
6f995e2d6c8d0d1d03cb3afcd1deafaf

SHA1
0319dbd8c7b44067b82fed5272059757a526b3aa

SHA256
cc4530fee96cf6e821fa1dbed0c46ac5310c57d6336999e3f93d29f78376f9eb

SHA512
207b4d327be81e71152ce35cb272362e9862e6002a6c01e9e9df37578c3764ac1c8d19b19e8e3b751162724490f06fea10611d7becabaff3863af993a90db16d

Download Submit
memory/1308-60-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/1308-59-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/1308-64-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/1308-65-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/1620-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1620-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1620-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2240-8-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2240-71-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4528-72-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-90-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-68-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-75-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-76-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-79-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-82-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-85-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-86-0x00000000029C0000-0x0000000002A62000-memory.dmp

Filesize
648KB

Download
memory/4528-69-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-96-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-99-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-102-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-105-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-108-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-111-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-114-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download
memory/4528-117-0x0000000000400000-0x00000000007F5000-memory.dmp

Filesize
4.0MB

Download