socks5systemz | 60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
02-07-2024 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.exe
Size

5.1MB
MD5

492f02162a70dec847c6bfed9d708cb5
SHA1

428678819734a91b7805a79ad4e6c0c8da6d7572
SHA256

60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1
SHA512

abe5bae26efbe2b490b14e5478997c2cc3705a6f464e3e84a7a8dda4c6f48f7b148e0309e934d9f982486d70ad2935639f982c0fb49d6026dbcece8979f43b6b
SSDEEP

98304:CcQeewV2lo/sjPYEtNBDbPdJ+vcmpHVmov9eKAGl/XQuzH6Cr/aT9Qx3:JfVzfEtNhVJ+vZoovbAGZXQMaH9Qx

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2788-88-0x0000000000B20000-0x0000000000BC2000-memory.dmp family_socks5systemz
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmpudadvdfreeripper32.exeudadvdfreeripper32.exe

pid process

3500 60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp
3004 udadvdfreeripper32.exe
2788 udadvdfreeripper32.exe
Loads dropped DLL 1 IoCs

Processes:

60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp

pid process

3500 60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 141.98.234.31
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp

pid process

3500 60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp

resource	yara_rule
behavioral2/memory/2788-88-0x0000000000B20000-0x0000000000BC2000-memory.dmp	family_socks5systemz

pid	process
3500	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp
3004	udadvdfreeripper32.exe
2788	udadvdfreeripper32.exe

pid	process
3500	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp

description	ioc
Destination IP	141.98.234.31

pid	process
3500	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.exe60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp

description	pid	process	target process
PID 124 wrote to memory of 3500	124	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.exe	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp
PID 124 wrote to memory of 3500	124	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.exe	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp
PID 124 wrote to memory of 3500	124	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.exe	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp
PID 3500 wrote to memory of 3004	3500	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp	udadvdfreeripper32.exe
PID 3500 wrote to memory of 3004	3500	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp	udadvdfreeripper32.exe
PID 3500 wrote to memory of 3004	3500	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp	udadvdfreeripper32.exe
PID 3500 wrote to memory of 2788	3500	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp	udadvdfreeripper32.exe
PID 3500 wrote to memory of 2788	3500	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp	udadvdfreeripper32.exe
PID 3500 wrote to memory of 2788	3500	60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp	udadvdfreeripper32.exe

C:\Users\Admin\AppData\Local\Temp\60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.exe
"C:\Users\Admin\AppData\Local\Temp\60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:124

C:\Users\Admin\AppData\Local\Temp\is-IOVQF.tmp\60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp
"C:\Users\Admin\AppData\Local\Temp\is-IOVQF.tmp\60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp" /SL5="$4021C,5112258,54272,C:\Users\Admin\AppData\Local\Temp\60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3500

C:\Users\Admin\AppData\Local\UDA DVD Free Ripper\udadvdfreeripper32.exe
"C:\Users\Admin\AppData\Local\UDA DVD Free Ripper\udadvdfreeripper32.exe" -i
3⤵
- Executes dropped EXE
PID:3004

C:\Users\Admin\AppData\Local\UDA DVD Free Ripper\udadvdfreeripper32.exe
"C:\Users\Admin\AppData\Local\UDA DVD Free Ripper\udadvdfreeripper32.exe" -s
3⤵
- Executes dropped EXE
PID:2788

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-FI09M.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IOVQF.tmp\60968a25a725013474a3635146b3fe175793dc368e474a3b214c62d562e941e1.tmp
Filesize
680KB

MD5
8dab69b38f40a0b79ea2b78ecfd189fc

SHA1
103ca432fee8effd77a33a70d9c4303513efbdc5

SHA256
2832d92067cbc0034c5d0064f5e75ece98b7efc3fb13d0ee6edf88af263303b6

SHA512
a3c8da7cbc9c28f362a0fc66b851c563c958f74dc559a3dae55a1b326daac0453fc2e36478bf5ffbe668fc4bf1a93ffc9971e98fe3bb2a7b0c11efce40e9a710

Download Submit
C:\Users\Admin\AppData\Local\UDA DVD Free Ripper\udadvdfreeripper32.exe
Filesize
3.9MB

MD5
214dda7997e03818a8a4c81c3b41cac7

SHA1
079d68cd6f5d6a4d5f477f78acea1698f995a53c

SHA256
9e62ed3f443df66d118f3adb52bd0681151666991355c32da367ea0622d24357

SHA512
a3f668cc40f651ac5182fd4eff9cddafc8c484ed2331f3c8c58d1f580786cf6bb1b92c1e8e170500aacd5bb07a9a3973e249235ef32097f450996159eb9315db

Download Submit
memory/124-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/124-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/124-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2788-90-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-96-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-117-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-114-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-69-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-68-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-111-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-108-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-72-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-75-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-76-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-79-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-82-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-85-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-88-0x0000000000B20000-0x0000000000BC2000-memory.dmp

Filesize
648KB

Download
memory/2788-105-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-102-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/2788-99-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/3004-64-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/3004-60-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/3004-59-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/3004-65-0x0000000000400000-0x00000000007E0000-memory.dmp

Filesize
3.9MB

Download
memory/3500-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3500-71-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download