Analysis
-
max time kernel
181s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
24-03-2022 13:42
General
-
Target
776dea13d3659a794cea95d8df98ef04d467959bf77358dba1ec06fb80a24bc2.exe
-
Size
359KB
-
MD5
e7257f950392e2d066876e0f2c0f4edc
-
SHA1
85d70a406fec548e52086ea5da1c7d106be5c2c9
-
SHA256
776dea13d3659a794cea95d8df98ef04d467959bf77358dba1ec06fb80a24bc2
-
SHA512
885a33de76be19e876299a7e030e80ce734065d2bf46a0cea2900ea706197e6abf898ee24929e26040748a0fd1be53ae96d891b76051cce56f7bd34cb2e7690d
Malware Config
Extracted
systembc
172.105.196.152:4114
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\776dea13d3659a794cea95d8df98ef04d467959bf77358dba1ec06fb80a24bc2.exe"C:\Users\Admin\AppData\Local\Temp\776dea13d3659a794cea95d8df98ef04d467959bf77358dba1ec06fb80a24bc2.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\ifjkln\wjui.exeC:\ProgramData\ifjkln\wjui.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
e7257f950392e2d066876e0f2c0f4edc
SHA185d70a406fec548e52086ea5da1c7d106be5c2c9
SHA256776dea13d3659a794cea95d8df98ef04d467959bf77358dba1ec06fb80a24bc2
SHA512885a33de76be19e876299a7e030e80ce734065d2bf46a0cea2900ea706197e6abf898ee24929e26040748a0fd1be53ae96d891b76051cce56f7bd34cb2e7690d
-
MD5
e7257f950392e2d066876e0f2c0f4edc
SHA185d70a406fec548e52086ea5da1c7d106be5c2c9
SHA256776dea13d3659a794cea95d8df98ef04d467959bf77358dba1ec06fb80a24bc2
SHA512885a33de76be19e876299a7e030e80ce734065d2bf46a0cea2900ea706197e6abf898ee24929e26040748a0fd1be53ae96d891b76051cce56f7bd34cb2e7690d
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
40KB
-
Filesize
1.4MB