Analysis
-
max time kernel
127s -
max time network
128s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-11-2020 10:30
General
-
Target
761e217f02855c7368259f63332d61df.exe
-
Size
266KB
-
MD5
761e217f02855c7368259f63332d61df
-
SHA1
a8f7630f3804f9d52da46e18efa0116ff5d4262b
-
SHA256
d896fea673941330bf9b4aca5ad7bd1b5e12d3768bfaea9521c843ac1324c629
-
SHA512
d24886f732a2e3d38e56ff56ea0e2f65eb686af2ace6c76368930505b1efcf2124727b65cbf2d406805ee9e73b074af8d6434e5503f8b14745625e3026a7278c
Malware Config
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\761e217f02855c7368259f63332d61df.exe"C:\Users\Admin\AppData\Local\Temp\761e217f02855c7368259f63332d61df.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\qojmqpt\cicv.exeC:\ProgramData\qojmqpt\cicv.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
761e217f02855c7368259f63332d61df
SHA1a8f7630f3804f9d52da46e18efa0116ff5d4262b
SHA256d896fea673941330bf9b4aca5ad7bd1b5e12d3768bfaea9521c843ac1324c629
SHA512d24886f732a2e3d38e56ff56ea0e2f65eb686af2ace6c76368930505b1efcf2124727b65cbf2d406805ee9e73b074af8d6434e5503f8b14745625e3026a7278c
-
MD5
761e217f02855c7368259f63332d61df
SHA1a8f7630f3804f9d52da46e18efa0116ff5d4262b
SHA256d896fea673941330bf9b4aca5ad7bd1b5e12d3768bfaea9521c843ac1324c629
SHA512d24886f732a2e3d38e56ff56ea0e2f65eb686af2ace6c76368930505b1efcf2124727b65cbf2d406805ee9e73b074af8d6434e5503f8b14745625e3026a7278c
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB