General
Target

5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe

Filesize

247KB

Completed

12-05-2022 12:06

Task

behavioral2

Score
10/10
MD5

aa00750f0df31493289bf07719cefd5e

SHA1

3c5b53cea10a28b955d1224ec2d293c639874593

SHA256

5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f

SHA256

cc679227e4e137885cfbf475e89f5832cbb3009b2e95aba661b6f2c973bc56672480e3c695daca6acf825fafcc8bc7e667ab92eb81da2d1aeb7d66deb55d7704

Malware Config

Extracted

Family

systembc

C2

217.8.117.114:4062

213.159.213.225:4062

Signatures 4

Filter: none

  • SystemBC

    Description

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Executes dropped EXE
    knwgpa.exe

    Reported IOCs

    pidprocess
    2492knwgpa.exe
  • Drops file in Windows directory
    5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Tasks\knwgpa.job5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe
    File opened for modificationC:\Windows\Tasks\knwgpa.job5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe
  • Suspicious behavior: EnumeratesProcesses
    5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe

    Reported IOCs

    pidprocess
    48165c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe
    48165c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe
    "C:\Users\Admin\AppData\Local\Temp\5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe"
    Drops file in Windows directory
    Suspicious behavior: EnumeratesProcesses
    PID:4816
  • C:\ProgramData\lmxc\knwgpa.exe
    C:\ProgramData\lmxc\knwgpa.exe start
    Executes dropped EXE
    PID:2492
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • C:\ProgramData\lmxc\knwgpa.exe

                            MD5

                            aa00750f0df31493289bf07719cefd5e

                            SHA1

                            3c5b53cea10a28b955d1224ec2d293c639874593

                            SHA256

                            5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f

                            SHA512

                            cc679227e4e137885cfbf475e89f5832cbb3009b2e95aba661b6f2c973bc56672480e3c695daca6acf825fafcc8bc7e667ab92eb81da2d1aeb7d66deb55d7704

                          • memory/2492-137-0x0000000077060000-0x0000000077203000-memory.dmp

                          • memory/2492-138-0x0000000077060000-0x0000000077203000-memory.dmp

                          • memory/2492-139-0x00000000012D0000-0x00000000012DB000-memory.dmp

                          • memory/2492-136-0x00000000009F0000-0x0000000000A00000-memory.dmp

                          • memory/4816-134-0x0000000000D20000-0x0000000000D2B000-memory.dmp

                          • memory/4816-131-0x0000000000C90000-0x0000000000CA0000-memory.dmp

                          • memory/4816-132-0x0000000077060000-0x0000000077203000-memory.dmp

                          • memory/4816-133-0x0000000077060000-0x0000000077203000-memory.dmp