Analysis
-
max time kernel
110s -
max time network
141s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
07-11-2021 09:38
Static task
static1
Behavioral task
behavioral1
Sample
313d1b2d4230e9de7f7bc5c3500b91a6.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
313d1b2d4230e9de7f7bc5c3500b91a6.exe
-
Size
190KB
-
MD5
313d1b2d4230e9de7f7bc5c3500b91a6
-
SHA1
194a4887da7619e775434bc9bcd9fce30f112d68
-
SHA256
6baa26e0f82719c4f8e763c7d7f584a925279fcf8c18644792a4a7091d5c64f0
-
SHA512
e559f5d5f51692f4897b42b501c5ede260761897da7db17b81e8a4909a9d3a60df2e2827fb365950f6335abeeab5ec5badff2179734e8ca2fb318139db344681
Malware Config
Extracted
Family
systembc
C2
91.209.70.71:4199
192.53.123.202:4199
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
313d1b2d4230e9de7f7bc5c3500b91a6.exedescription ioc process File created C:\Windows\Tasks\wow64.job 313d1b2d4230e9de7f7bc5c3500b91a6.exe File opened for modification C:\Windows\Tasks\wow64.job 313d1b2d4230e9de7f7bc5c3500b91a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\313d1b2d4230e9de7f7bc5c3500b91a6.exe"C:\Users\Admin\AppData\Local\Temp\313d1b2d4230e9de7f7bc5c3500b91a6.exe"1⤵
- Drops file in Windows directory
PID:3168
-
C:\Users\Admin\AppData\Local\Temp\313d1b2d4230e9de7f7bc5c3500b91a6.exeC:\Users\Admin\AppData\Local\Temp\313d1b2d4230e9de7f7bc5c3500b91a6.exe start1⤵PID:3984