Analysis

  • max time kernel
    61s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    09-07-2021 08:21

General

  • Target

    04017134f0091367122edfcb361e6295.exe

  • Size

    718KB

  • MD5

    04017134f0091367122edfcb361e6295

  • SHA1

    9b07524703418b5ebb053226caf456e76839cd20

  • SHA256

    c81c687949db0da1f1024238e01723a1145c5396e55bf81b5c154587b900ac4d

  • SHA512

    8289a307a02d0b49e1deb5818deafd05186da270a38844901c0d18069c486335f28f4837392aad385467ea43af22bd0a35250abeefeba5e3f79509273e58516a

Score
10/10

Malware Config

Extracted

Family

systembc

C2

185.215.113.32:4000

78.47.64.46:4000

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Drops file in Windows directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04017134f0091367122edfcb361e6295.exe
    "C:\Users\Admin\AppData\Local\Temp\04017134f0091367122edfcb361e6295.exe"
    1⤵
    • Drops file in Windows directory
    PID:3232
  • C:\Users\Admin\AppData\Local\Temp\04017134f0091367122edfcb361e6295.exe
    C:\Users\Admin\AppData\Local\Temp\04017134f0091367122edfcb361e6295.exe start
    1⤵
      PID:1520

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1520-117-0x00000000001D0000-0x00000000001F3000-memory.dmp

      Filesize

      140KB

    • memory/1520-119-0x0000000000400000-0x00000000004B9000-memory.dmp

      Filesize

      740KB

    • memory/3232-114-0x0000000000520000-0x000000000066A000-memory.dmp

      Filesize

      1.3MB

    • memory/3232-115-0x0000000002240000-0x0000000002245000-memory.dmp

      Filesize

      20KB

    • memory/3232-116-0x0000000000400000-0x00000000004B9000-memory.dmp

      Filesize

      740KB