General
Target

bb8dba7e21b5f0720407e0acdde6a34e.exe

Filesize

373KB

Completed

21-05-2022 14:40

Task

behavioral2

Score
10/10
MD5

bb8dba7e21b5f0720407e0acdde6a34e

SHA1

27e708c7940708ec158245bfb7f9f671f6664b13

SHA256

d94e02cfb25da71355a6d85538a24374c050962c4e027eaae2e230fe52514e2a

SHA512

b83aedd35920a402033d9381d67d5ade247afe55c8c5d7fc0eb5ee79d0c5cd69bd3e2538881e7d8d2bdcf04b65219f802d038b1757a395709e20b52462d12266

Malware Config

Extracted

Family

systembc

C2

135.125.248.50:443

146.70.53.169:443

Signatures 11

Filter: none

Defense Evasion
Discovery
  • SystemBC

    Description

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Downloads MZ/PE file
  • Executes dropped EXE
    5732955896.exe2647864961.exe2647864961.exe

    Reported IOCs

    pidprocess
    23365732955896.exe
    41562647864961.exe
    46962647864961.exe
  • Checks computer location settings
    bb8dba7e21b5f0720407e0acdde6a34e.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nationbb8dba7e21b5f0720407e0acdde6a34e.exe
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Drops file in Windows directory
    2647864961.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\Tasks\wow64.job2647864961.exe
    File opened for modificationC:\Windows\Tasks\wow64.job2647864961.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    10281596WerFault.exebb8dba7e21b5f0720407e0acdde6a34e.exe
  • Kills process with taskkill
    taskkill.exe

    Tags

    Reported IOCs

    pidprocess
    4788taskkill.exe
  • Suspicious use of AdjustPrivilegeToken
    taskkill.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege4788taskkill.exe
  • Suspicious use of WriteProcessMemory
    bb8dba7e21b5f0720407e0acdde6a34e.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1596 wrote to memory of 17601596bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1596 wrote to memory of 17601596bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1596 wrote to memory of 17601596bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1760 wrote to memory of 23361760cmd.exe5732955896.exe
    PID 1760 wrote to memory of 23361760cmd.exe5732955896.exe
    PID 1760 wrote to memory of 23361760cmd.exe5732955896.exe
    PID 1596 wrote to memory of 37441596bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1596 wrote to memory of 37441596bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1596 wrote to memory of 37441596bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 3744 wrote to memory of 41563744cmd.exe2647864961.exe
    PID 3744 wrote to memory of 41563744cmd.exe2647864961.exe
    PID 3744 wrote to memory of 41563744cmd.exe2647864961.exe
    PID 1596 wrote to memory of 38321596bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1596 wrote to memory of 38321596bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 1596 wrote to memory of 38321596bb8dba7e21b5f0720407e0acdde6a34e.execmd.exe
    PID 3832 wrote to memory of 47883832cmd.exetaskkill.exe
    PID 3832 wrote to memory of 47883832cmd.exetaskkill.exe
    PID 3832 wrote to memory of 47883832cmd.exetaskkill.exe
Processes 10
  • C:\Users\Admin\AppData\Local\Temp\bb8dba7e21b5f0720407e0acdde6a34e.exe
    "C:\Users\Admin\AppData\Local\Temp\bb8dba7e21b5f0720407e0acdde6a34e.exe"
    Checks computer location settings
    Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\5732955896.exe"
      Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Users\Admin\AppData\Local\Temp\5732955896.exe
        "C:\Users\Admin\AppData\Local\Temp\5732955896.exe"
        Executes dropped EXE
        PID:2336
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\2647864961.exe"
      Suspicious use of WriteProcessMemory
      PID:3744
      • C:\Users\Admin\AppData\Local\Temp\2647864961.exe
        "C:\Users\Admin\AppData\Local\Temp\2647864961.exe"
        Executes dropped EXE
        Drops file in Windows directory
        PID:4156
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "bb8dba7e21b5f0720407e0acdde6a34e.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bb8dba7e21b5f0720407e0acdde6a34e.exe" & exit
      Suspicious use of WriteProcessMemory
      PID:3832
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "bb8dba7e21b5f0720407e0acdde6a34e.exe" /f
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        PID:4788
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 1460
      Program crash
      PID:1028
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1596 -ip 1596
    PID:4896
  • C:\Users\Admin\AppData\Local\Temp\2647864961.exe
    C:\Users\Admin\AppData\Local\Temp\2647864961.exe start
    Executes dropped EXE
    PID:4696
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\2647864961.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • C:\Users\Admin\AppData\Local\Temp\2647864961.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • C:\Users\Admin\AppData\Local\Temp\2647864961.exe

                        MD5

                        c65326b66f8e1799d3b4b62ced8431ad

                        SHA1

                        2435632e756173e92a1f14e10573bdc32895a6c5

                        SHA256

                        c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

                        SHA512

                        034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

                      • C:\Users\Admin\AppData\Local\Temp\5732955896.exe

                        MD5

                        bd36b140501a2597a130c5d1a6105626

                        SHA1

                        ccb488217d9d32334fff09b0fb3d857e3ab4da6b

                        SHA256

                        1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

                        SHA512

                        882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

                      • C:\Users\Admin\AppData\Local\Temp\5732955896.exe

                        MD5

                        bd36b140501a2597a130c5d1a6105626

                        SHA1

                        ccb488217d9d32334fff09b0fb3d857e3ab4da6b

                        SHA256

                        1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

                        SHA512

                        882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

                      • memory/1596-131-0x0000000000620000-0x000000000064A000-memory.dmp

                      • memory/1596-132-0x0000000000400000-0x000000000049F000-memory.dmp

                      • memory/1596-130-0x0000000000726000-0x0000000000741000-memory.dmp

                      • memory/1760-133-0x0000000000000000-mapping.dmp

                      • memory/2336-134-0x0000000000000000-mapping.dmp

                      • memory/3744-137-0x0000000000000000-mapping.dmp

                      • memory/3832-141-0x0000000000000000-mapping.dmp

                      • memory/4156-138-0x0000000000000000-mapping.dmp

                      • memory/4156-144-0x0000000002330000-0x0000000002335000-memory.dmp

                      • memory/4156-145-0x0000000000400000-0x00000000004F4000-memory.dmp

                      • memory/4696-146-0x0000000000400000-0x00000000004F4000-memory.dmp

                      • memory/4788-142-0x0000000000000000-mapping.dmp