Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    08-06-2021 06:17

General

  • Target

    1.exe

  • Size

    886KB

  • MD5

    5fc8b735442c0761d95300c3ab2cd3f1

  • SHA1

    0c68b66cd251825596f6a9dbcd9cd664401012c8

  • SHA256

    36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

  • SHA512

    a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Score
10/10

Malware Config

Extracted

Family

systembc

C2

88.198.147.80:4174

78.47.64.46:4174

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Drops file in Windows directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    1⤵
    • Drops file in Windows directory
    PID:708
  • C:\Users\Admin\AppData\Local\Temp\1.exe
    C:\Users\Admin\AppData\Local\Temp\1.exe start
    1⤵
      PID:3300

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/708-114-0x0000000000640000-0x0000000000663000-memory.dmp

      Filesize

      140KB

    • memory/708-115-0x00000000007D0000-0x00000000007D5000-memory.dmp

      Filesize

      20KB

    • memory/708-116-0x0000000000400000-0x00000000004E2000-memory.dmp

      Filesize

      904KB

    • memory/3300-117-0x00000000001D0000-0x00000000001F3000-memory.dmp

      Filesize

      140KB

    • memory/3300-119-0x0000000000400000-0x00000000004E2000-memory.dmp

      Filesize

      904KB