General
Target

c65326b66f8e1799d3b4b62ced8431ad.exe

Filesize

946KB

Completed

21-05-2022 07:33

Task

behavioral2

Score
10/10
MD5

c65326b66f8e1799d3b4b62ced8431ad

SHA1

2435632e756173e92a1f14e10573bdc32895a6c5

SHA256

c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

SHA256

034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

Malware Config

Extracted

Family

systembc

C2

135.125.248.50:443

146.70.53.169:443

Signatures 2

Filter: none

  • SystemBC

    Description

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Drops file in Windows directory
    c65326b66f8e1799d3b4b62ced8431ad.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Tasks\wow64.jobc65326b66f8e1799d3b4b62ced8431ad.exe
    File opened for modificationC:\Windows\Tasks\wow64.jobc65326b66f8e1799d3b4b62ced8431ad.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe
    "C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe"
    Drops file in Windows directory
    PID:3288
  • C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe
    C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe start
    PID:2520
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/2520-132-0x0000000000400000-0x00000000004F4000-memory.dmp

                          • memory/3288-130-0x0000000002560000-0x0000000002565000-memory.dmp

                          • memory/3288-131-0x0000000000400000-0x00000000004F4000-memory.dmp