Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-11-2021 14:34
General
-
Target
soc.exe
-
Size
149KB
-
MD5
23e0db71f3d2182bb78ed5aaed6dbe31
-
SHA1
bdd3f63038f0c5cb80812289694da6e1d81b74ed
-
SHA256
1f65b5b41f6821ecb05aa14f391939ad2d527c7b1b48c377a5a4647051c5ae84
-
SHA512
03964f4dae03248bf3458d15334046632fc7ccc843f23f2b628a0e52aa162a347dfc5d7dd8307e98fa4e1cd17e9aa597513286859a6fbc2f9a124f9b54723ff3
Malware Config
Extracted
systembc
45.156.26.59:4179
217.182.46.152:4179
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Drops file in Windows directory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\soc.exe"C:\Users\Admin\AppData\Local\Temp\soc.exe"1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\soc.exeC:\Users\Admin\AppData\Local\Temp\soc.exe start1⤵
- Drops file in Windows directory
-
C:\Windows\TEMP\vrhmnjk.exeC:\Windows\TEMP\vrhmnjk.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\TEMP\vrhmnjk.exeC:\Windows\TEMP\vrhmnjk.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
23e0db71f3d2182bb78ed5aaed6dbe31
SHA1bdd3f63038f0c5cb80812289694da6e1d81b74ed
SHA2561f65b5b41f6821ecb05aa14f391939ad2d527c7b1b48c377a5a4647051c5ae84
SHA51203964f4dae03248bf3458d15334046632fc7ccc843f23f2b628a0e52aa162a347dfc5d7dd8307e98fa4e1cd17e9aa597513286859a6fbc2f9a124f9b54723ff3
-
MD5
4041ff2e1f0cf83ecdd32c31e69d5ce5
SHA1c4edbef864f6c6ff8469ca0b3ddaf92df9894f96
SHA256284ab8d1fbb2a02ea71d406511d55da654ade9a415413eaca8025d3192199df2
SHA512c6b764221b9c44f4cbae60e1a12ed1eee93ebad858ccf88095a76102b0ecfeead8e2c48a4befaed7e1aae7edb41bfc7dca137652db403fd0d9c021c8a9d434d8
-
MD5
23e0db71f3d2182bb78ed5aaed6dbe31
SHA1bdd3f63038f0c5cb80812289694da6e1d81b74ed
SHA2561f65b5b41f6821ecb05aa14f391939ad2d527c7b1b48c377a5a4647051c5ae84
SHA51203964f4dae03248bf3458d15334046632fc7ccc843f23f2b628a0e52aa162a347dfc5d7dd8307e98fa4e1cd17e9aa597513286859a6fbc2f9a124f9b54723ff3
-
MD5
23e0db71f3d2182bb78ed5aaed6dbe31
SHA1bdd3f63038f0c5cb80812289694da6e1d81b74ed
SHA2561f65b5b41f6821ecb05aa14f391939ad2d527c7b1b48c377a5a4647051c5ae84
SHA51203964f4dae03248bf3458d15334046632fc7ccc843f23f2b628a0e52aa162a347dfc5d7dd8307e98fa4e1cd17e9aa597513286859a6fbc2f9a124f9b54723ff3
-
Filesize
184KB
-
Filesize
24KB
-
Filesize
696KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
20KB
-
Filesize
1.3MB
-
Filesize
184KB
-
Filesize
1.3MB
-
Filesize
1.3MB