General
Target

bb8dba7e21b5f0720407e0acdde6a34e.exe

Filesize

373KB

Completed

21-05-2022 14:40

Task

behavioral1

Score
10/10
MD5

bb8dba7e21b5f0720407e0acdde6a34e

SHA1

27e708c7940708ec158245bfb7f9f671f6664b13

SHA256

d94e02cfb25da71355a6d85538a24374c050962c4e027eaae2e230fe52514e2a

SHA512

b83aedd35920a402033d9381d67d5ade247afe55c8c5d7fc0eb5ee79d0c5cd69bd3e2538881e7d8d2bdcf04b65219f802d038b1757a395709e20b52462d12266

Malware Config

Extracted

Family

systembc

C2

135.125.248.50:443

146.70.53.169:443

Signatures 11

Filter: none

Defense Evasion
Discovery
  • SystemBC

    Description

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Downloads MZ/PE file
  • Executes dropped EXE
    4460637101.exe1142939930.exe1142939930.exe

    Reported IOCs

    pidprocess
    13684460637101.exe
    11201142939930.exe
    12521142939930.exe
  • Deletes itself
    cmd.exe

    Reported IOCs

    pidprocess
    328cmd.exe
  • Loads dropped DLL
    cmd.execmd.exe

    Reported IOCs

    pidprocess
    1172cmd.exe
    1768cmd.exe
    1768cmd.exe
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Drops file in Windows directory
    1142939930.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Tasks\wow64.job1142939930.exe
    File opened for modificationC:\Windows\Tasks\wow64.job1142939930.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Kills process with taskkill
    taskkill.exe

    Tags

    Reported IOCs

    pidprocess
    1828taskkill.exe
  • Suspicious use of AdjustPrivilegeToken
    taskkill.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1828taskkill.exe
  • Suspicious use of WriteProcessMemory
    bb8dba7e21b5f0720407e0acdde6a34e.execmd.execmd.execmd.exetaskeng.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1648 wrote to memory of 11721648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1648 wrote to memory of 11721648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1648 wrote to memory of 11721648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1648 wrote to memory of 11721648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1172 wrote to memory of 13681172cmd.exe4460637101.exe
    PID 1172 wrote to memory of 13681172cmd.exe4460637101.exe
    PID 1172 wrote to memory of 13681172cmd.exe4460637101.exe
    PID 1172 wrote to memory of 13681172cmd.exe4460637101.exe
    PID 1648 wrote to memory of 17681648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1648 wrote to memory of 17681648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1648 wrote to memory of 17681648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1648 wrote to memory of 17681648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1768 wrote to memory of 11201768cmd.exe1142939930.exe
    PID 1768 wrote to memory of 11201768cmd.exe1142939930.exe
    PID 1768 wrote to memory of 11201768cmd.exe1142939930.exe
    PID 1768 wrote to memory of 11201768cmd.exe1142939930.exe
    PID 1648 wrote to memory of 3281648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1648 wrote to memory of 3281648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1648 wrote to memory of 3281648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1648 wrote to memory of 3281648bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 328 wrote to memory of 1828328cmd.exetaskkill.exe
    PID 328 wrote to memory of 1828328cmd.exetaskkill.exe
    PID 328 wrote to memory of 1828328cmd.exetaskkill.exe
    PID 328 wrote to memory of 1828328cmd.exetaskkill.exe
    PID 1756 wrote to memory of 12521756taskeng.exe1142939930.exe
    PID 1756 wrote to memory of 12521756taskeng.exe1142939930.exe
    PID 1756 wrote to memory of 12521756taskeng.exe1142939930.exe
    PID 1756 wrote to memory of 12521756taskeng.exe1142939930.exe
Processes 9
  • C:\Users\Admin\AppData\Local\Temp\bb8dba7e21b5f0720407e0acdde6a34e.exe
    "C:\Users\Admin\AppData\Local\Temp\bb8dba7e21b5f0720407e0acdde6a34e.exe"
    Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4460637101.exe"
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Users\Admin\AppData\Local\Temp\4460637101.exe
        "C:\Users\Admin\AppData\Local\Temp\4460637101.exe"
        Executes dropped EXE
        PID:1368
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1142939930.exe"
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Users\Admin\AppData\Local\Temp\1142939930.exe
        "C:\Users\Admin\AppData\Local\Temp\1142939930.exe"
        Executes dropped EXE
        Drops file in Windows directory
        PID:1120
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "bb8dba7e21b5f0720407e0acdde6a34e.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bb8dba7e21b5f0720407e0acdde6a34e.exe" & exit
      Deletes itself
      Suspicious use of WriteProcessMemory
      PID:328
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "bb8dba7e21b5f0720407e0acdde6a34e.exe" /f
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        PID:1828
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {9C3FEB19-5B3E-4289-99C4-C02EC3D28153} S-1-5-18:NT AUTHORITY\System:Service:
    Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Users\Admin\AppData\Local\Temp\1142939930.exe
      C:\Users\Admin\AppData\Local\Temp\1142939930.exe start
      Executes dropped EXE
      PID:1252
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\1142939930.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • C:\Users\Admin\AppData\Local\Temp\1142939930.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • C:\Users\Admin\AppData\Local\Temp\1142939930.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • C:\Users\Admin\AppData\Local\Temp\4460637101.exe

                        MD5

                        bd36b140501a2597a130c5d1a6105626

                        SHA1

                        ccb488217d9d32334fff09b0fb3d857e3ab4da6b

                        SHA256

                        1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

                        SHA512

                        882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

                      • C:\Users\Admin\AppData\Local\Temp\4460637101.exe

                        MD5

                        bd36b140501a2597a130c5d1a6105626

                        SHA1

                        ccb488217d9d32334fff09b0fb3d857e3ab4da6b

                        SHA256

                        1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

                        SHA512

                        882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

                      • \Users\Admin\AppData\Local\Temp\1142939930.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • \Users\Admin\AppData\Local\Temp\1142939930.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • \Users\Admin\AppData\Local\Temp\4460637101.exe

                        MD5

                        bd36b140501a2597a130c5d1a6105626

                        SHA1

                        ccb488217d9d32334fff09b0fb3d857e3ab4da6b

                        SHA256

                        1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

                        SHA512

                        882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

                      • memory/328-70-0x0000000000000000-mapping.dmp

                      • memory/1120-72-0x00000000006B0000-0x00000000006B5000-memory.dmp

                      • memory/1120-67-0x0000000000000000-mapping.dmp

                      • memory/1120-73-0x0000000000400000-0x00000000004F4000-memory.dmp

                      • memory/1172-58-0x0000000000000000-mapping.dmp

                      • memory/1252-74-0x0000000000000000-mapping.dmp

                      • memory/1252-77-0x0000000000400000-0x00000000004F4000-memory.dmp

                      • memory/1368-61-0x0000000000000000-mapping.dmp

                      • memory/1648-54-0x00000000755C1000-0x00000000755C3000-memory.dmp

                      • memory/1648-57-0x0000000000400000-0x000000000049F000-memory.dmp

                      • memory/1648-55-0x00000000005EA000-0x0000000000605000-memory.dmp

                      • memory/1648-56-0x0000000000220000-0x000000000024A000-memory.dmp

                      • memory/1768-63-0x0000000000000000-mapping.dmp

                      • memory/1828-71-0x0000000000000000-mapping.dmp