Overview

overview

10

Static

static

dridex

windows10-2004_x64

10

Analysis

  • max time kernel
    112s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    14-03-2022 02:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae487bcbd066a3bca802abb7b65f69691a0ffa850aa24ef0441a18243bbda46a.exe

  • Size

    232KB

  • MD5

    d4bf806a2cd1f84ccdcff2184c93dc90

  • SHA1

    1c110e247459619b11e316ab8a119136be8cd337

  • SHA256

    ae487bcbd066a3bca802abb7b65f69691a0ffa850aa24ef0441a18243bbda46a

  • SHA512

    0e73dee591753e84e08f290833b5bd39ba60be355e362477fb811e29c7e1c81da6566f00f17a3c6bea179284960360fda21075152a328a2925643214bd0ec124

Score
10/10
systembcsuricatatrojan

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • suricata: ET MALWARE Win32/SystemBC CnC Checkin

    suricata: ET MALWARE Win32/SystemBC CnC Checkin

    suricata
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae487bcbd066a3bca802abb7b65f69691a0ffa850aa24ef0441a18243bbda46a.exe
    "C:\Users\Admin\AppData\Local\Temp\ae487bcbd066a3bca802abb7b65f69691a0ffa850aa24ef0441a18243bbda46a.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3468
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 484
      2⤵
      • Program crash
      PID:1512
  • C:\ProgramData\bwcw\hmwhr.exe
    C:\ProgramData\bwcw\hmwhr.exe start
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:684
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3468 -ip 3468
    1⤵
      PID:2208

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\bwcw\hmwhr.exe
      MD5

      d4bf806a2cd1f84ccdcff2184c93dc90

      SHA1

      1c110e247459619b11e316ab8a119136be8cd337

      SHA256

      ae487bcbd066a3bca802abb7b65f69691a0ffa850aa24ef0441a18243bbda46a

      SHA512

      0e73dee591753e84e08f290833b5bd39ba60be355e362477fb811e29c7e1c81da6566f00f17a3c6bea179284960360fda21075152a328a2925643214bd0ec124

      Download Submit
    • C:\ProgramData\bwcw\hmwhr.exe
      MD5

      d4bf806a2cd1f84ccdcff2184c93dc90

      SHA1

      1c110e247459619b11e316ab8a119136be8cd337

      SHA256

      ae487bcbd066a3bca802abb7b65f69691a0ffa850aa24ef0441a18243bbda46a

      SHA512

      0e73dee591753e84e08f290833b5bd39ba60be355e362477fb811e29c7e1c81da6566f00f17a3c6bea179284960360fda21075152a328a2925643214bd0ec124

      Download Submit
    • memory/684-140-0x00000000006AD000-0x00000000006B6000-memory.dmp
      Filesize

      36KB

      Download
    • memory/684-141-0x00000000006AD000-0x00000000006B6000-memory.dmp
      Filesize

      36KB

      Download
    • memory/684-142-0x0000000000400000-0x000000000046B000-memory.dmp
      Filesize

      428KB

      Download
    • memory/3468-134-0x00000000007F1000-0x00000000007FA000-memory.dmp
      Filesize

      36KB

      Download
    • memory/3468-135-0x00000000007F1000-0x00000000007FA000-memory.dmp
      Filesize

      36KB

      Download
    • memory/3468-136-0x0000000000700000-0x0000000000709000-memory.dmp
      Filesize

      36KB

      Download
    • memory/3468-137-0x0000000000400000-0x000000000046B000-memory.dmp
      Filesize

      428KB

      Download