Overview

overview

10

Static

static

b93187507f...25.exe

windows7_x64

10

b93187507f...25.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    158s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-05-2022 02:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825.exe

  • Size

    121KB

  • MD5

    e60119dd588f168109ae6d25a187202d

  • SHA1

    0b3cde408aa8eea80fbf9a8868a6cd194dc2b022

  • SHA256

    b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825

  • SHA512

    731ed02e9cb967bca1cddf93251ee607d499912df7dfbdf6720faa7339ea25674828d846052852b95bd4f4e8f1a7e287aa2883addd4eb6f1aaf75b13f59b9eac

Score
10/10
systembcsuricatatrojan

Malware Config

Extracted

Family

systembc

C2

sdadvert197.com:4044

mexstat128.com:4044

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query

    suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query

    suricata
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops file in Windows directory 2 IoCs
  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825.exe
    "C:\Users\Admin\AppData\Local\Temp\b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:5048
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 948
      2⤵
      • Program crash
      PID:4384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 964
      2⤵
      • Program crash
      PID:4260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 972
      2⤵
      • Program crash
      PID:312
  • C:\ProgramData\aosn\mslx.exe
    C:\ProgramData\aosn\mslx.exe start
    1⤵
    • Executes dropped EXE
    PID:3620
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5048 -ip 5048
    1⤵
      PID:4392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5048 -ip 5048
      1⤵
        PID:116
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5048 -ip 5048
        1⤵
          PID:1272

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Credential Access

        Discovery

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Connection Proxy

        1
        T1090

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\aosn\mslx.exe
          Filesize

          121KB

          MD5

          e60119dd588f168109ae6d25a187202d

          SHA1

          0b3cde408aa8eea80fbf9a8868a6cd194dc2b022

          SHA256

          b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825

          SHA512

          731ed02e9cb967bca1cddf93251ee607d499912df7dfbdf6720faa7339ea25674828d846052852b95bd4f4e8f1a7e287aa2883addd4eb6f1aaf75b13f59b9eac

          Download Submit
        • C:\ProgramData\aosn\mslx.exe
          Filesize

          121KB

          MD5

          e60119dd588f168109ae6d25a187202d

          SHA1

          0b3cde408aa8eea80fbf9a8868a6cd194dc2b022

          SHA256

          b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825

          SHA512

          731ed02e9cb967bca1cddf93251ee607d499912df7dfbdf6720faa7339ea25674828d846052852b95bd4f4e8f1a7e287aa2883addd4eb6f1aaf75b13f59b9eac

          Download Submit
        • memory/3620-135-0x0000000003423000-0x0000000003429000-memory.dmp
          Filesize

          24KB

          Download
        • memory/3620-136-0x0000000000400000-0x00000000031D1000-memory.dmp
          Filesize

          45.8MB

          Download
        • memory/5048-130-0x0000000003488000-0x000000000348F000-memory.dmp
          Filesize

          28KB

          Download
        • memory/5048-131-0x0000000003430000-0x0000000003439000-memory.dmp
          Filesize

          36KB

          Download
        • memory/5048-132-0x0000000000400000-0x00000000031D1000-memory.dmp
          Filesize

          45.8MB

          Download