Analysis
-
max time kernel
133s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27-09-2022 21:12
General
-
Target
715a725a1a6ae5c7d3437b0c2914afef7d585aafa068e2d2e9331826000e1bac.exe
-
Size
6.1MB
-
MD5
00fcb83ba5ccfc06e0d188da8f7199d9
-
SHA1
d25177c49632ebd00606aca4dc74dc86c2809197
-
SHA256
715a725a1a6ae5c7d3437b0c2914afef7d585aafa068e2d2e9331826000e1bac
-
SHA512
615594dbbdbb73475ee30222fb61b81f48c831518c13a7041acc3e7ceca35d6f4829c44f7bac15e74504b913c06105f13854b041dc61e5ce3c25bd55b6fa16f6
-
SSDEEP
98304:+Mu3f/jr6blqCtAZhO0oNtHjgKPUbzSTcLYUkwf8M2m51AjLrLrQ/8:+Vf/v6bl3tNXtoQcLs/M2mDAjPLF
Malware Config
Extracted
systembc
89.22.225.242:4193
195.2.93.22:4193
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Themida packer 7 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\715a725a1a6ae5c7d3437b0c2914afef7d585aafa068e2d2e9331826000e1bac.exe"C:\Users\Admin\AppData\Local\Temp\715a725a1a6ae5c7d3437b0c2914afef7d585aafa068e2d2e9331826000e1bac.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\TypeRes\DllResource.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\TypeRes\DllResource.exe"C:\Users\Admin\TypeRes\DllResource.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\715a725a1a6ae5c7d3437b0c2914afef7d585aafa068e2d2e9331826000e1bac.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\TypeRes\DllResource.exeFilesize
700.0MB
MD54e8c645ac2b31f58e9156a78e3d2825e
SHA1a3f518128dd25043187621b830eb54206b52ccfd
SHA256f6793331418cbb1588d3e54e3824bca3387bf205331d12cdf4750cf2bea3d921
SHA512d45ddcaccdd1b3f6aa4bd6bcb6e5cd3fdc6f406ba7b7613cce9419f09ccc145529061279b5d2b26fc16e6597abf1adb2a351b4b2f8f283c6ac36cbb4e2d2fc30
-
C:\Users\Admin\TypeRes\DllResource.exeFilesize
761.9MB
MD5a12e9fc3dc0d2cbe4df5cd43745a5cca
SHA1b8d474bb7d737a059c9296c523b8dcbced5af6e2
SHA256a14b1da1e21d7423bcb1f65eefd3982f121cb9ee7d827004a8d483015cc6ba00
SHA5127b03fba4e9a2ddbf8ba85638d3d3739058e9a5aa5e0baf0d2502d8a1b3abd7117425d3bd1102c2ba2c380fd53ac1c865f39cc93a6e3d42a0236b3851057a7359
-
memory/220-148-0x0000000000000000-mapping.dmp
-
memory/2504-140-0x0000000000000000-mapping.dmp
-
memory/2552-149-0x0000000000000000-mapping.dmp
-
memory/3180-144-0x0000000000000000-mapping.dmp
-
memory/4208-151-0x0000000000400000-0x0000000001022000-memory.dmpFilesize
12.1MB
-
memory/4208-155-0x0000000000400000-0x0000000001022000-memory.dmpFilesize
12.1MB
-
memory/4208-157-0x00000000030A1000-0x0000000003220000-memory.dmpFilesize
1.5MB
-
memory/4208-158-0x000000000D420000-0x000000000D4B1000-memory.dmpFilesize
580KB
-
memory/4208-159-0x000000000D420000-0x000000000D4B1000-memory.dmpFilesize
580KB
-
memory/4208-141-0x0000000000000000-mapping.dmp
-
memory/4208-156-0x000000000326F000-0x00000000039FF000-memory.dmpFilesize
7.6MB
-
memory/4208-154-0x0000000076EF0000-0x0000000077093000-memory.dmpFilesize
1.6MB
-
memory/4208-153-0x00000000030A1000-0x0000000003220000-memory.dmpFilesize
1.5MB
-
memory/4208-152-0x000000000326F000-0x00000000039FF000-memory.dmpFilesize
7.6MB
-
memory/4208-160-0x000000000D400000-0x000000000D407000-memory.dmpFilesize
28KB
-
memory/4208-163-0x000000000D420000-0x000000000D4B1000-memory.dmpFilesize
580KB
-
memory/4208-150-0x0000000076EF0000-0x0000000077093000-memory.dmpFilesize
1.6MB
-
memory/5044-139-0x00000000039A8000-0x0000000003B27000-memory.dmpFilesize
1.5MB
-
memory/5044-147-0x00000000039A8000-0x0000000003B27000-memory.dmpFilesize
1.5MB
-
memory/5044-146-0x0000000000400000-0x0000000001022000-memory.dmpFilesize
12.1MB
-
memory/5044-145-0x0000000076EF0000-0x0000000077093000-memory.dmpFilesize
1.6MB
-
memory/5044-132-0x0000000000400000-0x0000000001022000-memory.dmpFilesize
12.1MB
-
memory/5044-138-0x0000000003200000-0x0000000003990000-memory.dmpFilesize
7.6MB
-
memory/5044-137-0x0000000076EF0000-0x0000000077093000-memory.dmpFilesize
1.6MB
-
memory/5044-136-0x0000000000400000-0x0000000001022000-memory.dmpFilesize
12.1MB
-
memory/5044-135-0x00000000039A8000-0x0000000003B27000-memory.dmpFilesize
1.5MB
-
memory/5044-134-0x0000000003200000-0x0000000003990000-memory.dmpFilesize
7.6MB
-
memory/5044-133-0x0000000076EF0000-0x0000000077093000-memory.dmpFilesize
1.6MB