Resubmissions
11-04-2024 09:02
240411-kzhm3agc46 1011-04-2024 09:00
240411-kynspabd3y 1011-04-2024 09:00
240411-kym66abd3x 1011-04-2024 09:00
240411-kymkmagc29 1011-04-2024 09:00
240411-kyly4abd3w 10Analysis
-
max time kernel
151s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-04-2022 17:55
Static task
static1
Behavioral task
behavioral1
Sample
90334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882.exe
Resource
win7-20220414-en
General
-
Target
90334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882.exe
-
Size
87KB
-
MD5
c130eba9ff855403a69ec4adc6ae5db0
-
SHA1
71c0f3213e23fc9f1c0c5d14c0095c6b59aa7446
-
SHA256
90334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882
-
SHA512
35308bf15552b0168488eb0dfcf7fac077f79626d9e684a5bd57004d87d7e06ae5aa0c348d9866ccb6aa2e190d3727b8cde5b744f6c5ac5be4ab1aad452e6586
Malware Config
Extracted
systembc
asdasd08.com:4039
asdasd08.xyz:4039
Signatures
-
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
-
Executes dropped EXE 1 IoCs
Processes:
svijqh.exepid process 1340 svijqh.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org 6 api.ipify.org 7 ip4.seeip.org 8 ip4.seeip.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
90334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882.exedescription ioc process File created C:\Windows\Tasks\svijqh.job 90334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882.exe File opened for modification C:\Windows\Tasks\svijqh.job 90334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
90334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882.exepid process 1588 90334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 936 wrote to memory of 1340 936 taskeng.exe svijqh.exe PID 936 wrote to memory of 1340 936 taskeng.exe svijqh.exe PID 936 wrote to memory of 1340 936 taskeng.exe svijqh.exe PID 936 wrote to memory of 1340 936 taskeng.exe svijqh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882.exe"C:\Users\Admin\AppData\Local\Temp\90334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {11C400B0-9D9D-46C3-93B8-6A381E1EBC3F} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\dwtlcxr\svijqh.exeC:\ProgramData\dwtlcxr\svijqh.exe start2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\dwtlcxr\svijqh.exeFilesize
87KB
MD5c130eba9ff855403a69ec4adc6ae5db0
SHA171c0f3213e23fc9f1c0c5d14c0095c6b59aa7446
SHA25690334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882
SHA51235308bf15552b0168488eb0dfcf7fac077f79626d9e684a5bd57004d87d7e06ae5aa0c348d9866ccb6aa2e190d3727b8cde5b744f6c5ac5be4ab1aad452e6586
-
C:\ProgramData\dwtlcxr\svijqh.exeFilesize
87KB
MD5c130eba9ff855403a69ec4adc6ae5db0
SHA171c0f3213e23fc9f1c0c5d14c0095c6b59aa7446
SHA25690334ecb93afa6abb9d5739738b4b03437b0ee1829253bb3c4b966a1bf9f3882
SHA51235308bf15552b0168488eb0dfcf7fac077f79626d9e684a5bd57004d87d7e06ae5aa0c348d9866ccb6aa2e190d3727b8cde5b744f6c5ac5be4ab1aad452e6586
-
memory/1340-59-0x0000000000000000-mapping.dmp
-
memory/1340-62-0x000000000028B000-0x0000000000292000-memory.dmpFilesize
28KB
-
memory/1340-63-0x0000000000400000-0x0000000002FA1000-memory.dmpFilesize
43.6MB
-
memory/1588-54-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/1588-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1588-55-0x000000000305B000-0x0000000003062000-memory.dmpFilesize
28KB
-
memory/1588-57-0x0000000000400000-0x0000000002FA1000-memory.dmpFilesize
43.6MB