Overview

overview

10

Static

static

c65326b66f8e17...ad.exe

windows7_x64

10

c65326b66f8e17...ad.exe

windows10-2004_x64

10
General
Target

c65326b66f8e1799d3b4b62ced8431ad.exe

Filesize

946KB

Completed

21-05-2022 07:33

Task

behavioral1

Score
10/10
MD5

c65326b66f8e1799d3b4b62ced8431ad

SHA1

2435632e756173e92a1f14e10573bdc32895a6c5

SHA256

c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

SHA256

034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

Malware Config

Extracted

Family

systembc
C2

135.125.248.50:443

146.70.53.169:443
Signatures 3

Filter: none

  • SystemBC

    Description

    SystemBC is a proxy and remote administration tool first seen in 2019.

    Tags

  • Drops file in Windows directory
    c65326b66f8e1799d3b4b62ced8431ad.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Tasks\wow64.jobc65326b66f8e1799d3b4b62ced8431ad.exe
    File opened for modificationC:\Windows\Tasks\wow64.jobc65326b66f8e1799d3b4b62ced8431ad.exe
  • Suspicious use of WriteProcessMemory
    taskeng.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 992 wrote to memory of 1636992taskeng.exec65326b66f8e1799d3b4b62ced8431ad.exe
    PID 992 wrote to memory of 1636992taskeng.exec65326b66f8e1799d3b4b62ced8431ad.exe
    PID 992 wrote to memory of 1636992taskeng.exec65326b66f8e1799d3b4b62ced8431ad.exe
    PID 992 wrote to memory of 1636992taskeng.exec65326b66f8e1799d3b4b62ced8431ad.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe
    "C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe"
    Drops file in Windows directory
    PID:1968
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {A7016F27-5C55-4949-BAD2-1E658EB2803F} S-1-5-18:NT AUTHORITY\System:Service:
    Suspicious use of WriteProcessMemory
    PID:992
    • C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe
      C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe start
      PID:1636
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/1636-57-0x0000000000000000-mapping.dmp

                            Download

                          • memory/1636-59-0x0000000000400000-0x00000000004F4000-memory.dmp

                            Download

                          • memory/1968-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

                            Download

                          • memory/1968-55-0x00000000002D0000-0x00000000002D5000-memory.dmp

                            Download

                          • memory/1968-56-0x0000000000400000-0x00000000004F4000-memory.dmp

                            Download