Analysis
-
max time kernel
110s -
max time network
141s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
12-11-2021 11:56
Static task
static1
General
-
Target
410205b0ea535125414c3bc330ec887987a0970152996d71dde7b23f6e268ae8.exe
-
Size
158KB
-
MD5
67b765d020ea05247cbbea18ad7cddd5
-
SHA1
7d05411bb0f311d237da7e1fff9e6866cae909c0
-
SHA256
410205b0ea535125414c3bc330ec887987a0970152996d71dde7b23f6e268ae8
-
SHA512
4363edd76a917f7490a7bae7eda20f1d05b57f58f45ba27c4339ea8479d80361cf06a79fd46fdc758c7a1fbccf10fdbb10b0c0a8a3bc580c57c78a5b168ad136
Malware Config
Extracted
Family
systembc
C2
91.212.150.113:4199
192.53.123.202:4199
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
410205b0ea535125414c3bc330ec887987a0970152996d71dde7b23f6e268ae8.exedescription ioc process File created C:\Windows\Tasks\wow64.job 410205b0ea535125414c3bc330ec887987a0970152996d71dde7b23f6e268ae8.exe File opened for modification C:\Windows\Tasks\wow64.job 410205b0ea535125414c3bc330ec887987a0970152996d71dde7b23f6e268ae8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\410205b0ea535125414c3bc330ec887987a0970152996d71dde7b23f6e268ae8.exe"C:\Users\Admin\AppData\Local\Temp\410205b0ea535125414c3bc330ec887987a0970152996d71dde7b23f6e268ae8.exe"1⤵
- Drops file in Windows directory
PID:3520
-
C:\Users\Admin\AppData\Local\Temp\410205b0ea535125414c3bc330ec887987a0970152996d71dde7b23f6e268ae8.exeC:\Users\Admin\AppData\Local\Temp\410205b0ea535125414c3bc330ec887987a0970152996d71dde7b23f6e268ae8.exe start1⤵PID:3408