Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
11-11-2021 15:39
Static task
static1
General
-
Target
eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe
-
Size
344KB
-
MD5
16348a65fd6fe52ea47ef258389429b1
-
SHA1
4b63f1be14718c36a2976e6ffec69cb9bbc283a7
-
SHA256
eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a
-
SHA512
77f668e1ab39d62df52817202f5d855f76c5659efba101ea3a180fe95bfdd21ac32eacc99915c874af0f50d12632312bc29b0e4cee1ff9cfaaac00a35ec2ce08
Malware Config
Extracted
Family
systembc
C2
91.212.150.113:4199
192.53.123.202:4199
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exedescription ioc process File created C:\Windows\Tasks\wow64.job eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe File opened for modification C:\Windows\Tasks\wow64.job eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe"C:\Users\Admin\AppData\Local\Temp\eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe"1⤵
- Drops file in Windows directory
PID:2772
-
C:\Users\Admin\AppData\Local\Temp\eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exeC:\Users\Admin\AppData\Local\Temp\eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe start1⤵PID:324