Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/03/2021, 07:09
General
- Target edf555fc092865d05d3c666e1f4d43b3.exe
- Size 195KB
- Sample210311-2xv2aewb5j
- SHA256 d397561a5bb963a3bdff021676cad184c81e4ad6fee1601d15924f144fe1e73a
Score
10/10
Malware Config
Extracted
Family
-
systembc
C2
-
anarhi2402.com:4039
-
anarhi2402.xyz:4039
Signatures
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\edf555fc092865d05d3c666e1f4d43b3.exe"C:\Users\Admin\AppData\Local\Temp\edf555fc092865d05d3c666e1f4d43b3.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\fcswejo\qtlwr.exeC:\ProgramData\fcswejo\qtlwr.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3980-7-0x0000000003170000-0x0000000003171000-memory.dmp
memory/4692-2-0x0000000003170000-0x0000000003171000-memory.dmp
memory/4692-4-0x0000000000400000-0x000000000040B000-memory.dmp
memory/4692-3-0x0000000000030000-0x0000000000039000-memory.dmp