General
Target

09a5565e828aa3da2f70b21cbc21b08b.exe

Filesize

372KB

Completed

21-05-2022 06:52

Task

behavioral1

Score
10/10
MD5

09a5565e828aa3da2f70b21cbc21b08b

SHA1

fbdb5431f6373262c69715c1ce3b4eb691c16714

SHA256

fdd7069cdc8a066739331213b2076f2ca6acd0e97070f5d1e4dbd9d1b756a35b

SHA512

236897b15b20214eeb42e10a171a77cede6a7c29cc1295255c4f69c3fe53d2623fa4ebc3ae142d1fb2a28f0527d7245ecd7822f9b9a8450de1af875eacbd8a64

Malware Config

Extracted

Family

systembc

C2

135.125.248.50:443

146.70.53.169:443

Signatures 11

Filter: none

Defense Evasion
Discovery
  • SystemBC

    Description

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Downloads MZ/PE file
  • Executes dropped EXE
    4715676164.exe9378610649.exe9378610649.exe

    Reported IOCs

    pidprocess
    10044715676164.exe
    1129378610649.exe
    5689378610649.exe
  • Deletes itself
    cmd.exe

    Reported IOCs

    pidprocess
    1364cmd.exe
  • Loads dropped DLL
    cmd.execmd.exe

    Reported IOCs

    pidprocess
    2008cmd.exe
    648cmd.exe
    648cmd.exe
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Drops file in Windows directory
    9378610649.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Tasks\wow64.job9378610649.exe
    File opened for modificationC:\Windows\Tasks\wow64.job9378610649.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Kills process with taskkill
    taskkill.exe

    Tags

    Reported IOCs

    pidprocess
    1928taskkill.exe
  • Suspicious use of AdjustPrivilegeToken
    taskkill.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1928taskkill.exe
  • Suspicious use of WriteProcessMemory
    09a5565e828aa3da2f70b21cbc21b08b.execmd.execmd.exetaskeng.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1748 wrote to memory of 2008174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 1748 wrote to memory of 2008174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 1748 wrote to memory of 2008174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 1748 wrote to memory of 2008174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 2008 wrote to memory of 10042008cmd.exe4715676164.exe
    PID 2008 wrote to memory of 10042008cmd.exe4715676164.exe
    PID 2008 wrote to memory of 10042008cmd.exe4715676164.exe
    PID 2008 wrote to memory of 10042008cmd.exe4715676164.exe
    PID 1748 wrote to memory of 648174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 1748 wrote to memory of 648174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 1748 wrote to memory of 648174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 1748 wrote to memory of 648174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 648 wrote to memory of 112648cmd.exe9378610649.exe
    PID 648 wrote to memory of 112648cmd.exe9378610649.exe
    PID 648 wrote to memory of 112648cmd.exe9378610649.exe
    PID 648 wrote to memory of 112648cmd.exe9378610649.exe
    PID 1016 wrote to memory of 5681016taskeng.exe9378610649.exe
    PID 1016 wrote to memory of 5681016taskeng.exe9378610649.exe
    PID 1016 wrote to memory of 5681016taskeng.exe9378610649.exe
    PID 1016 wrote to memory of 5681016taskeng.exe9378610649.exe
    PID 1748 wrote to memory of 1364174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 1748 wrote to memory of 1364174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 1748 wrote to memory of 1364174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 1748 wrote to memory of 1364174809a5565e828aa3da2f70b21cbc21b08b.execmd.exe
    PID 1364 wrote to memory of 19281364cmd.exetaskkill.exe
    PID 1364 wrote to memory of 19281364cmd.exetaskkill.exe
    PID 1364 wrote to memory of 19281364cmd.exetaskkill.exe
    PID 1364 wrote to memory of 19281364cmd.exetaskkill.exe
Processes 9
  • C:\Users\Admin\AppData\Local\Temp\09a5565e828aa3da2f70b21cbc21b08b.exe
    "C:\Users\Admin\AppData\Local\Temp\09a5565e828aa3da2f70b21cbc21b08b.exe"
    Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4715676164.exe"
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Users\Admin\AppData\Local\Temp\4715676164.exe
        "C:\Users\Admin\AppData\Local\Temp\4715676164.exe"
        Executes dropped EXE
        PID:1004
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\9378610649.exe"
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:648
      • C:\Users\Admin\AppData\Local\Temp\9378610649.exe
        "C:\Users\Admin\AppData\Local\Temp\9378610649.exe"
        Executes dropped EXE
        Drops file in Windows directory
        PID:112
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "09a5565e828aa3da2f70b21cbc21b08b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\09a5565e828aa3da2f70b21cbc21b08b.exe" & exit
      Deletes itself
      Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "09a5565e828aa3da2f70b21cbc21b08b.exe" /f
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        PID:1928
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {8D2A1A27-70A2-4258-933A-50570D68468C} S-1-5-18:NT AUTHORITY\System:Service:
    Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Users\Admin\AppData\Local\Temp\9378610649.exe
      C:\Users\Admin\AppData\Local\Temp\9378610649.exe start
      Executes dropped EXE
      PID:568
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\4715676164.exe

                        MD5

                        bd36b140501a2597a130c5d1a6105626

                        SHA1

                        ccb488217d9d32334fff09b0fb3d857e3ab4da6b

                        SHA256

                        1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

                        SHA512

                        882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

                      • C:\Users\Admin\AppData\Local\Temp\4715676164.exe

                        MD5

                        bd36b140501a2597a130c5d1a6105626

                        SHA1

                        ccb488217d9d32334fff09b0fb3d857e3ab4da6b

                        SHA256

                        1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

                        SHA512

                        882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

                      • C:\Users\Admin\AppData\Local\Temp\9378610649.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • C:\Users\Admin\AppData\Local\Temp\9378610649.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • C:\Users\Admin\AppData\Local\Temp\9378610649.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • \Users\Admin\AppData\Local\Temp\4715676164.exe

                        MD5

                        bd36b140501a2597a130c5d1a6105626

                        SHA1

                        ccb488217d9d32334fff09b0fb3d857e3ab4da6b

                        SHA256

                        1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

                        SHA512

                        882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

                      • \Users\Admin\AppData\Local\Temp\9378610649.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • \Users\Admin\AppData\Local\Temp\9378610649.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • memory/112-67-0x0000000000000000-mapping.dmp

                      • memory/112-71-0x0000000000400000-0x00000000004F4000-memory.dmp

                      • memory/112-70-0x0000000000290000-0x0000000000295000-memory.dmp

                      • memory/568-72-0x0000000000000000-mapping.dmp

                      • memory/568-75-0x0000000000400000-0x00000000004F4000-memory.dmp

                      • memory/648-63-0x0000000000000000-mapping.dmp

                      • memory/1004-61-0x0000000000000000-mapping.dmp

                      • memory/1364-76-0x0000000000000000-mapping.dmp

                      • memory/1748-54-0x0000000075761000-0x0000000075763000-memory.dmp

                      • memory/1748-57-0x0000000000400000-0x0000000002B7B000-memory.dmp

                      • memory/1748-55-0x0000000002C6E000-0x0000000002C89000-memory.dmp

                      • memory/1748-56-0x0000000000220000-0x000000000024A000-memory.dmp

                      • memory/1928-77-0x0000000000000000-mapping.dmp

                      • memory/2008-58-0x0000000000000000-mapping.dmp