socks5systemz | 96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
03-07-2024 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.exe
Size

5.3MB
MD5

c51a0b6c89c4df20879e4edb9cfe70a0
SHA1

c7b190b8927696ede122b79ba5d40c1a6b7d4c86
SHA256

96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97
SHA512

cf39ba14c049fc995869caa8ed1a1c9dc3e43df95575fe6674a488e6b6e99229d1a9e41f3f19535ec33079ccf9b8f20068249b002d220853e7f946e218ab4485
SSDEEP

98304:CjlIKXI034vFbICXxFKwtarhPKpc70UQvFJ4gos0QzkKaid3Kp4mBKOdQxDa:EIg4vRXxFKKMhSEGJ4zs/zPA7BKIQpa

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3580-86-0x0000000000BF0000-0x0000000000C92000-memory.dmp	family_socks5systemz
behavioral2/memory/3580-110-0x0000000000BF0000-0x0000000000C92000-memory.dmp	family_socks5systemz
behavioral2/memory/3580-111-0x0000000000BF0000-0x0000000000C92000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmppionaudioplayer.exepionaudioplayer.exe

pid process

3556 96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp
3536 pionaudioplayer.exe
3580 pionaudioplayer.exe
Loads dropped DLL 1 IoCs

Processes:

96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp

pid process

3556 96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 141.98.234.31
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp

pid process

3556 96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp

pid	process
3556	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp
3536	pionaudioplayer.exe
3580	pionaudioplayer.exe

pid	process
3556	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp

description	ioc
Destination IP	141.98.234.31

pid	process
3556	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.exe96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp

description	pid	process	target process
PID 4724 wrote to memory of 3556	4724	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.exe	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp
PID 4724 wrote to memory of 3556	4724	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.exe	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp
PID 4724 wrote to memory of 3556	4724	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.exe	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp
PID 3556 wrote to memory of 3536	3556	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp	pionaudioplayer.exe
PID 3556 wrote to memory of 3536	3556	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp	pionaudioplayer.exe
PID 3556 wrote to memory of 3536	3556	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp	pionaudioplayer.exe
PID 3556 wrote to memory of 3580	3556	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp	pionaudioplayer.exe
PID 3556 wrote to memory of 3580	3556	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp	pionaudioplayer.exe
PID 3556 wrote to memory of 3580	3556	96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp	pionaudioplayer.exe

C:\Users\Admin\AppData\Local\Temp\96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.exe
"C:\Users\Admin\AppData\Local\Temp\96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4724

C:\Users\Admin\AppData\Local\Temp\is-TJTB9.tmp\96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp
"C:\Users\Admin\AppData\Local\Temp\is-TJTB9.tmp\96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp" /SL5="$40216,5287326,54272,C:\Users\Admin\AppData\Local\Temp\96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3556

C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe
"C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe" -i
3⤵
- Executes dropped EXE
PID:3536

C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe
"C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe" -s
3⤵
- Executes dropped EXE
PID:3580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Pion Audio Player\pionaudioplayer.exe
Filesize
4.0MB

MD5
9b31a96f4666542461ea395f5b43439c

SHA1
80654cd93c1652e65f95bd15bb7fcd0969b25d76

SHA256
b6e313e1a207e0b8991e0883eff6234ebebd82a5d192c97ea67d0a0d563e5e48

SHA512
6777ddd0faf3fb9d0f0247a9cedf2de735d360c7ccfc7d8268b6de6e336a2bbc81d425df2e0585d59a5a3fac902eae84d0fa0daed772b5ee8da7820b47c7ddeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-B6LMN.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TJTB9.tmp\96a1b0b916cdc2d97067066697b30b70848666676cf77489d82299981229bc97.tmp
Filesize
680KB

MD5
1c47be7867d5fb90ccf37808d1474f67

SHA1
0b24f8cba4f8f9e85df1dc144e37c5a36d8ef144

SHA256
d192cd666c467b89c52c7de07238e3e1ce7f494b015f7c9c0c3f859ed78a93d9

SHA512
574d89abf82c0f8ea5a40e59556c732890d71e8d4e7c677d151da0494dcdd8a95b14eb79dccbb4e92fd9295c233a12b9baf2ff7373639aa53290a2f57c24c1e8

Download Submit
memory/3536-59-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3536-60-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3536-64-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3556-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3556-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3580-74-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-106-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-68-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-118-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-115-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-71-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-111-0x0000000000BF0000-0x0000000000C92000-memory.dmp

Filesize
648KB

Download
memory/3580-77-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-80-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-83-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-86-0x0000000000BF0000-0x0000000000C92000-memory.dmp

Filesize
648KB

Download
memory/3580-89-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-94-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-97-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-100-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-103-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-67-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-109-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/3580-110-0x0000000000BF0000-0x0000000000C92000-memory.dmp

Filesize
648KB

Download
memory/4724-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4724-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4724-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download