Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    03-05-2022 14:52

General

  • Target

    38916764de03427d1ef5b77729bd3486e8429fd7966cc306a79e5e5e248a36cc.exe

  • Size

    107KB

  • MD5

    c76206e3213212b73b3efa6a51d9c1d6

  • SHA1

    3ed40c6f3553b7f02ab984693258b6120577aa2d

  • SHA256

    38916764de03427d1ef5b77729bd3486e8429fd7966cc306a79e5e5e248a36cc

  • SHA512

    fc1826163547e7d3b907da45bca77e52df96a056fa99c7830c8663ffcb7720a7ec4481dec3baa965dfa6e0dfd914f1bb85d5b4680b1e8d2b0da0a6d0a45b0854

Score
10/10

Malware Config

Extracted

Family

systembc

C2

ok22asddvr.com:4035

ok22asddvr.xyz:4035

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38916764de03427d1ef5b77729bd3486e8429fd7966cc306a79e5e5e248a36cc.exe
    "C:\Users\Admin\AppData\Local\Temp\38916764de03427d1ef5b77729bd3486e8429fd7966cc306a79e5e5e248a36cc.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1492
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {3497B7DC-88D3-4ED5-8835-C3CE5F0A3DE4} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\ProgramData\opvq\plwdwh.exe
      C:\ProgramData\opvq\plwdwh.exe start
      2⤵
      • Executes dropped EXE
      PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Command and Control

Connection Proxy

1
T1090

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\opvq\plwdwh.exe
    Filesize

    107KB

    MD5

    c76206e3213212b73b3efa6a51d9c1d6

    SHA1

    3ed40c6f3553b7f02ab984693258b6120577aa2d

    SHA256

    38916764de03427d1ef5b77729bd3486e8429fd7966cc306a79e5e5e248a36cc

    SHA512

    fc1826163547e7d3b907da45bca77e52df96a056fa99c7830c8663ffcb7720a7ec4481dec3baa965dfa6e0dfd914f1bb85d5b4680b1e8d2b0da0a6d0a45b0854

  • C:\ProgramData\opvq\plwdwh.exe
    Filesize

    107KB

    MD5

    c76206e3213212b73b3efa6a51d9c1d6

    SHA1

    3ed40c6f3553b7f02ab984693258b6120577aa2d

    SHA256

    38916764de03427d1ef5b77729bd3486e8429fd7966cc306a79e5e5e248a36cc

    SHA512

    fc1826163547e7d3b907da45bca77e52df96a056fa99c7830c8663ffcb7720a7ec4481dec3baa965dfa6e0dfd914f1bb85d5b4680b1e8d2b0da0a6d0a45b0854

  • memory/1368-59-0x0000000000000000-mapping.dmp
  • memory/1368-62-0x000000000061B000-0x0000000000622000-memory.dmp
    Filesize

    28KB

  • memory/1368-63-0x0000000000400000-0x00000000004D5000-memory.dmp
    Filesize

    852KB

  • memory/1492-54-0x0000000074C81000-0x0000000074C83000-memory.dmp
    Filesize

    8KB

  • memory/1492-56-0x0000000000220000-0x0000000000229000-memory.dmp
    Filesize

    36KB

  • memory/1492-55-0x000000000093B000-0x0000000000942000-memory.dmp
    Filesize

    28KB

  • memory/1492-57-0x0000000000400000-0x00000000004D5000-memory.dmp
    Filesize

    852KB