Overview

overview

10

Static

static

35081647c1...f1.exe

windows7_x64

10

35081647c1...f1.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    153s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    27-04-2022 15:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    35081647c14bfe19928e04f3c04fec9f9a66e98b364d0d27f3f057b0f98186f1.exe

  • Size

    265KB

  • MD5

    b15da1de33a731f12b3574c1e6845a1c

  • SHA1

    08c12f9d8032dcb1f465cb1b57b8c2bc267f2ba6

  • SHA256

    35081647c14bfe19928e04f3c04fec9f9a66e98b364d0d27f3f057b0f98186f1

  • SHA512

    3df7cfa9fabd23119d8dbc1f99aafca7388aaae14fcdb9283fed7f7c29930ef9e2129160b94887371c1bdd78083fa3d57171b2405bd686a255b22fb5950f618f

Score
10/10
systembcsuricatatrojan

Malware Config

Extracted

Family

systembc

C2

advertrex20.xyz:4044

gentexman37.xyz:4044

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query

    suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query

    suricata
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops file in Windows directory 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35081647c14bfe19928e04f3c04fec9f9a66e98b364d0d27f3f057b0f98186f1.exe
    "C:\Users\Admin\AppData\Local\Temp\35081647c14bfe19928e04f3c04fec9f9a66e98b364d0d27f3f057b0f98186f1.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 484
      2⤵
      • Program crash
      PID:4672
  • C:\ProgramData\apghnu\uwjxhtx.exe
    C:\ProgramData\apghnu\uwjxhtx.exe start
    1⤵
    • Executes dropped EXE
    PID:2912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4052 -ip 4052
    1⤵
      PID:3836

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Connection Proxy

    1
    T1090

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\apghnu\uwjxhtx.exe
      Filesize

      265KB

      MD5

      b15da1de33a731f12b3574c1e6845a1c

      SHA1

      08c12f9d8032dcb1f465cb1b57b8c2bc267f2ba6

      SHA256

      35081647c14bfe19928e04f3c04fec9f9a66e98b364d0d27f3f057b0f98186f1

      SHA512

      3df7cfa9fabd23119d8dbc1f99aafca7388aaae14fcdb9283fed7f7c29930ef9e2129160b94887371c1bdd78083fa3d57171b2405bd686a255b22fb5950f618f

      Download Submit
    • C:\ProgramData\apghnu\uwjxhtx.exe
      Filesize

      265KB

      MD5

      b15da1de33a731f12b3574c1e6845a1c

      SHA1

      08c12f9d8032dcb1f465cb1b57b8c2bc267f2ba6

      SHA256

      35081647c14bfe19928e04f3c04fec9f9a66e98b364d0d27f3f057b0f98186f1

      SHA512

      3df7cfa9fabd23119d8dbc1f99aafca7388aaae14fcdb9283fed7f7c29930ef9e2129160b94887371c1bdd78083fa3d57171b2405bd686a255b22fb5950f618f

      Download Submit
    • memory/2912-135-0x0000000000400000-0x00000000004D2000-memory.dmp
      Filesize

      840KB

      Download
    • memory/4052-130-0x0000000000030000-0x0000000000036000-memory.dmp
      Filesize

      24KB

      Download
    • memory/4052-131-0x0000000000520000-0x0000000000529000-memory.dmp
      Filesize

      36KB

      Download
    • memory/4052-132-0x0000000000400000-0x00000000004D2000-memory.dmp
      Filesize

      840KB

      Download