Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-11-2020 10:53
General
-
Target
25bb7618c80b2f912790e7f54f898a5f.exe
-
Size
959KB
-
MD5
25bb7618c80b2f912790e7f54f898a5f
-
SHA1
96ffd62a194f6436592dd9a3c59fe9223bb72611
-
SHA256
f57aff01f0d6a36bddeb8e7bbf8b33874c47a58d7827399c823424866aee33dd
-
SHA512
d63fb34e6f6dd0d4ecde2bccf9ddb67c1516d4f4c82bce6f8479b0bfed6fafca7bd4b5f02b71859387f30ca432fc0c262df5e5739e6ba44b40f45b1e85c0e312
Malware Config
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25bb7618c80b2f912790e7f54f898a5f.exe"C:\Users\Admin\AppData\Local\Temp\25bb7618c80b2f912790e7f54f898a5f.exe"1⤵
- Drops file in Windows directory
-
C:\ProgramData\nrha\wgbwbtw.exeC:\ProgramData\nrha\wgbwbtw.exe start1⤵
- Executes dropped EXE
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
25bb7618c80b2f912790e7f54f898a5f
SHA196ffd62a194f6436592dd9a3c59fe9223bb72611
SHA256f57aff01f0d6a36bddeb8e7bbf8b33874c47a58d7827399c823424866aee33dd
SHA512d63fb34e6f6dd0d4ecde2bccf9ddb67c1516d4f4c82bce6f8479b0bfed6fafca7bd4b5f02b71859387f30ca432fc0c262df5e5739e6ba44b40f45b1e85c0e312
-
MD5
25bb7618c80b2f912790e7f54f898a5f
SHA196ffd62a194f6436592dd9a3c59fe9223bb72611
SHA256f57aff01f0d6a36bddeb8e7bbf8b33874c47a58d7827399c823424866aee33dd
SHA512d63fb34e6f6dd0d4ecde2bccf9ddb67c1516d4f4c82bce6f8479b0bfed6fafca7bd4b5f02b71859387f30ca432fc0c262df5e5739e6ba44b40f45b1e85c0e312