Overview

overview

10

Static

static

8401fa8aa0...c2.exe

windows7_x64

10

8401fa8aa0...c2.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    201s
  • max time network
    207s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    27-04-2022 17:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8401fa8aa07c8cd1d4f46e41f70fd2db414f288db8c324ea61ea5dcd5c99b3c2.exe

  • Size

    87KB

  • MD5

    edeea6a91e82cf4da5cb8209580b4e74

  • SHA1

    182c6cf748e0a1b5f4a12b9a761b3b6982017e6d

  • SHA256

    8401fa8aa07c8cd1d4f46e41f70fd2db414f288db8c324ea61ea5dcd5c99b3c2

  • SHA512

    7530eb2471bb1c65612e7f16793942d7ca02e8b994f390341090eef129634ff604018fb0fe1abe5443d68a7f739719ba332a934e4a0fa7d0bcd8ef1094723226

Score
10/10
systembcsuricatatrojan

Malware Config

Extracted

Family

systembc

C2

advertrex20.xyz:4044

gentexman37.xyz:4044

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query

    suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query

    suricata
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8401fa8aa07c8cd1d4f46e41f70fd2db414f288db8c324ea61ea5dcd5c99b3c2.exe
    "C:\Users\Admin\AppData\Local\Temp\8401fa8aa07c8cd1d4f46e41f70fd2db414f288db8c324ea61ea5dcd5c99b3c2.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2876
  • C:\ProgramData\fxnr\lstmoja.exe
    C:\ProgramData\fxnr\lstmoja.exe start
    1⤵
    • Executes dropped EXE
    PID:344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

1
T1090

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\fxnr\lstmoja.exe
    Filesize

    87KB

    MD5

    edeea6a91e82cf4da5cb8209580b4e74

    SHA1

    182c6cf748e0a1b5f4a12b9a761b3b6982017e6d

    SHA256

    8401fa8aa07c8cd1d4f46e41f70fd2db414f288db8c324ea61ea5dcd5c99b3c2

    SHA512

    7530eb2471bb1c65612e7f16793942d7ca02e8b994f390341090eef129634ff604018fb0fe1abe5443d68a7f739719ba332a934e4a0fa7d0bcd8ef1094723226

    Download Submit
  • C:\ProgramData\fxnr\lstmoja.exe
    Filesize

    87KB

    MD5

    edeea6a91e82cf4da5cb8209580b4e74

    SHA1

    182c6cf748e0a1b5f4a12b9a761b3b6982017e6d

    SHA256

    8401fa8aa07c8cd1d4f46e41f70fd2db414f288db8c324ea61ea5dcd5c99b3c2

    SHA512

    7530eb2471bb1c65612e7f16793942d7ca02e8b994f390341090eef129634ff604018fb0fe1abe5443d68a7f739719ba332a934e4a0fa7d0bcd8ef1094723226

    Download Submit
  • memory/344-135-0x0000000003183000-0x0000000003189000-memory.dmp
    Filesize

    24KB

    Download
  • memory/344-136-0x0000000000400000-0x0000000002FA1000-memory.dmp
    Filesize

    43.6MB

    Download
  • memory/2876-130-0x00000000030C8000-0x00000000030CF000-memory.dmp
    Filesize

    28KB

    Download
  • memory/2876-131-0x0000000003070000-0x0000000003079000-memory.dmp
    Filesize

    36KB

    Download
  • memory/2876-132-0x0000000000400000-0x0000000002FA1000-memory.dmp
    Filesize

    43.6MB

    Download