Analysis

  • max time kernel
    121s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    11-11-2021 15:39

General

  • Target

    eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe

  • Size

    344KB

  • MD5

    16348a65fd6fe52ea47ef258389429b1

  • SHA1

    4b63f1be14718c36a2976e6ffec69cb9bbc283a7

  • SHA256

    eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a

  • SHA512

    77f668e1ab39d62df52817202f5d855f76c5659efba101ea3a180fe95bfdd21ac32eacc99915c874af0f50d12632312bc29b0e4cee1ff9cfaaac00a35ec2ce08

Score
10/10

Malware Config

Extracted

Family

systembc

C2

91.212.150.113:4199

192.53.123.202:4199

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Drops file in Windows directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe
    "C:\Users\Admin\AppData\Local\Temp\eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe"
    1⤵
    • Drops file in Windows directory
    PID:2772
  • C:\Users\Admin\AppData\Local\Temp\eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe
    C:\Users\Admin\AppData\Local\Temp\eb66cf9eca49dd0e6c7981940e26574b55166ee597a35ec81ab5173867fadc0a.exe start
    1⤵
      PID:324

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/324-120-0x0000000000400000-0x0000000002B4D000-memory.dmp

      Filesize

      39.3MB

    • memory/324-119-0x0000000002B50000-0x0000000002BFE000-memory.dmp

      Filesize

      696KB

    • memory/2772-115-0x0000000002E16000-0x0000000002E26000-memory.dmp

      Filesize

      64KB

    • memory/2772-116-0x0000000002CB0000-0x0000000002CB5000-memory.dmp

      Filesize

      20KB

    • memory/2772-117-0x0000000000400000-0x0000000002B4D000-memory.dmp

      Filesize

      39.3MB