Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2022, 06:52

General

  • Target

    684b62ef735f504178ef6455be50b2a6.exe

  • Size

    32KB

  • MD5

    684b62ef735f504178ef6455be50b2a6

  • SHA1

    3ee91e1162e2925f896250545269f297bed06814

  • SHA256

    ffe11c5c82b3e725526bf00b707e52cc713600436c5382868b46b4e4a96ba344

  • SHA512

    3972bca78223e878e244ba191b86ffb993a69ef818613539b6d91d435436889b4e5d95260943d25cbf94250fa26abeff8870f6ca70f5558ec37e890a257f7c9c

  • SSDEEP

    768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2zKc6lUZJFg:YLJ8dayaaupDobnpo24w

Score
10/10

Malware Config

Extracted

Family

systembc

C2

45.182.189.231:443

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\684b62ef735f504178ef6455be50b2a6.exe
    "C:\Users\Admin\AppData\Local\Temp\684b62ef735f504178ef6455be50b2a6.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4072
  • C:\ProgramData\ewegie\mvfoqp.exe
    C:\ProgramData\ewegie\mvfoqp.exe start
    1⤵
    • Executes dropped EXE
    PID:3652

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\ewegie\mvfoqp.exe

          Filesize

          32KB

          MD5

          684b62ef735f504178ef6455be50b2a6

          SHA1

          3ee91e1162e2925f896250545269f297bed06814

          SHA256

          ffe11c5c82b3e725526bf00b707e52cc713600436c5382868b46b4e4a96ba344

          SHA512

          3972bca78223e878e244ba191b86ffb993a69ef818613539b6d91d435436889b4e5d95260943d25cbf94250fa26abeff8870f6ca70f5558ec37e890a257f7c9c

        • C:\ProgramData\ewegie\mvfoqp.exe

          Filesize

          32KB

          MD5

          684b62ef735f504178ef6455be50b2a6

          SHA1

          3ee91e1162e2925f896250545269f297bed06814

          SHA256

          ffe11c5c82b3e725526bf00b707e52cc713600436c5382868b46b4e4a96ba344

          SHA512

          3972bca78223e878e244ba191b86ffb993a69ef818613539b6d91d435436889b4e5d95260943d25cbf94250fa26abeff8870f6ca70f5558ec37e890a257f7c9c