Analysis

  • max time kernel
    61s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    06-07-2021 06:24

General

  • Target

    9f2cc4d1d0c599bab186692c518d3193.exe

  • Size

    780KB

  • MD5

    9f2cc4d1d0c599bab186692c518d3193

  • SHA1

    968c9f9a7829c77d8d9553accb9dbd9ead717386

  • SHA256

    b9c6bfa4ad09302620dfe9c7edf398cb3a6249c7cdd8d9be61395d857083a3c3

  • SHA512

    aca1f7c734652dc537e3c2cb5204dc7e682a28d9941e870a7bfba964a7236fc1219537ae3558017e9e48dd6a016fb342f1ae2aa4d84e41f619200d5e4900f159

Score
10/10

Malware Config

Extracted

Family

systembc

C2

185.215.113.32:4000

78.47.64.46:4000

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Drops file in Windows directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f2cc4d1d0c599bab186692c518d3193.exe
    "C:\Users\Admin\AppData\Local\Temp\9f2cc4d1d0c599bab186692c518d3193.exe"
    1⤵
    • Drops file in Windows directory
    PID:3456
  • C:\Users\Admin\AppData\Local\Temp\9f2cc4d1d0c599bab186692c518d3193.exe
    C:\Users\Admin\AppData\Local\Temp\9f2cc4d1d0c599bab186692c518d3193.exe start
    1⤵
      PID:2008

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2008-117-0x00000000001D0000-0x00000000001F3000-memory.dmp

      Filesize

      140KB

    • memory/2008-119-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/3456-114-0x00000000005F0000-0x00000000005F1000-memory.dmp

      Filesize

      4KB

    • memory/3456-116-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/3456-115-0x0000000000770000-0x0000000000775000-memory.dmp

      Filesize

      20KB