Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-12-2020 08:14
General
-
Target
c96012bf82cc15058dd53887b068bbd8.exe
-
Size
267KB
-
MD5
c96012bf82cc15058dd53887b068bbd8
-
SHA1
3502862e8ef4edd8ff5a427849d8c9f38e45160d
-
SHA256
36a101b5a13436dd67e2b33c2abbae7cdd86a7ed951185a1914c12685339ad74
-
SHA512
315495dcba5d3624ce716ea534a1f74d7256f176b06a7dac006b64d8019ce4dc9ae67857466d1a838ab8bd02ad70fb14b4e425ab29e5e00c6ab8b19a0d94e56a
Malware Config
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Executes dropped EXE 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c96012bf82cc15058dd53887b068bbd8.exe"C:\Users\Admin\AppData\Local\Temp\c96012bf82cc15058dd53887b068bbd8.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\evsfvjb\kxaaao.exeC:\ProgramData\evsfvjb\kxaaao.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c96012bf82cc15058dd53887b068bbd8
SHA13502862e8ef4edd8ff5a427849d8c9f38e45160d
SHA25636a101b5a13436dd67e2b33c2abbae7cdd86a7ed951185a1914c12685339ad74
SHA512315495dcba5d3624ce716ea534a1f74d7256f176b06a7dac006b64d8019ce4dc9ae67857466d1a838ab8bd02ad70fb14b4e425ab29e5e00c6ab8b19a0d94e56a
-
MD5
c96012bf82cc15058dd53887b068bbd8
SHA13502862e8ef4edd8ff5a427849d8c9f38e45160d
SHA25636a101b5a13436dd67e2b33c2abbae7cdd86a7ed951185a1914c12685339ad74
SHA512315495dcba5d3624ce716ea534a1f74d7256f176b06a7dac006b64d8019ce4dc9ae67857466d1a838ab8bd02ad70fb14b4e425ab29e5e00c6ab8b19a0d94e56a
-
Filesize
4KB
-
Filesize
4KB