Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    10/11/2022, 06:52

General

  • Target

    684b62ef735f504178ef6455be50b2a6.exe

  • Size

    32KB

  • MD5

    684b62ef735f504178ef6455be50b2a6

  • SHA1

    3ee91e1162e2925f896250545269f297bed06814

  • SHA256

    ffe11c5c82b3e725526bf00b707e52cc713600436c5382868b46b4e4a96ba344

  • SHA512

    3972bca78223e878e244ba191b86ffb993a69ef818613539b6d91d435436889b4e5d95260943d25cbf94250fa26abeff8870f6ca70f5558ec37e890a257f7c9c

  • SSDEEP

    768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2zKc6lUZJFg:YLJ8dayaaupDobnpo24w

Score
10/10

Malware Config

Extracted

Family

systembc

C2

45.182.189.231:443

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\684b62ef735f504178ef6455be50b2a6.exe
    "C:\Users\Admin\AppData\Local\Temp\684b62ef735f504178ef6455be50b2a6.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1896
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {E795C970-2D52-40CB-9568-981640EA5A58} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\ProgramData\jtnctk\fsuteo.exe
      C:\ProgramData\jtnctk\fsuteo.exe start
      2⤵
      • Executes dropped EXE
      PID:1264

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\jtnctk\fsuteo.exe

          Filesize

          32KB

          MD5

          684b62ef735f504178ef6455be50b2a6

          SHA1

          3ee91e1162e2925f896250545269f297bed06814

          SHA256

          ffe11c5c82b3e725526bf00b707e52cc713600436c5382868b46b4e4a96ba344

          SHA512

          3972bca78223e878e244ba191b86ffb993a69ef818613539b6d91d435436889b4e5d95260943d25cbf94250fa26abeff8870f6ca70f5558ec37e890a257f7c9c

        • C:\ProgramData\jtnctk\fsuteo.exe

          Filesize

          32KB

          MD5

          684b62ef735f504178ef6455be50b2a6

          SHA1

          3ee91e1162e2925f896250545269f297bed06814

          SHA256

          ffe11c5c82b3e725526bf00b707e52cc713600436c5382868b46b4e4a96ba344

          SHA512

          3972bca78223e878e244ba191b86ffb993a69ef818613539b6d91d435436889b4e5d95260943d25cbf94250fa26abeff8870f6ca70f5558ec37e890a257f7c9c

        • memory/1896-54-0x0000000076181000-0x0000000076183000-memory.dmp

          Filesize

          8KB