Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
17-11-2022 08:16
General
-
Target
4592c6b5f38f82e9c50fcd6c4b5f2c33b925c57933fcaeb400979dce7cf04454.exe
-
Size
163KB
-
MD5
bb8e86a3fc33caae318aab15fc4d5aeb
-
SHA1
02f9c735807fb78f7a5fade3bf6c0cf34396fe95
-
SHA256
4592c6b5f38f82e9c50fcd6c4b5f2c33b925c57933fcaeb400979dce7cf04454
-
SHA512
c7739f21b200393995b5e3e6b9ab8df59110b0f54ee33285ab6c8e385db1ad30aa652d0335080e95124ef8caab5600b013d748cb809fa7a32806766e024e831c
-
SSDEEP
3072:TrJlWRnGCoMOTjt5wimxSYrF+eeo/yS5Z6pr4QpBh6JnlgPD:HyZHpi1YrF+TOL6pkEh
Malware Config
Extracted
systembc
89.248.165.79:443
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4592c6b5f38f82e9c50fcd6c4b5f2c33b925c57933fcaeb400979dce7cf04454.exe"C:\Users\Admin\AppData\Local\Temp\4592c6b5f38f82e9c50fcd6c4b5f2c33b925c57933fcaeb400979dce7cf04454.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\DA72.exeC:\Users\Admin\AppData\Local\Temp\DA72.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\ProgramData\bbcrc\mloc.exeC:\ProgramData\bbcrc\mloc.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163KB
MD5ede4e0e4f4547b54a24a170161ae4542
SHA17b15b83ebd70c52302e0dea0dea0404026298713
SHA2565411181f4261c8a1b21450ea7376df3d60003b19ad6ad6c6e1fbee2e4b6b8e32
SHA512d602b165419d1c52e612027208e14a6dde2debfe0efc77c10041e9b02f95ddfe0996d1a6b6d3ad212e00a0f51cfe86cc767f38c5610d9f279b0191d169ddd0f4
-
Filesize
163KB
MD5ede4e0e4f4547b54a24a170161ae4542
SHA17b15b83ebd70c52302e0dea0dea0404026298713
SHA2565411181f4261c8a1b21450ea7376df3d60003b19ad6ad6c6e1fbee2e4b6b8e32
SHA512d602b165419d1c52e612027208e14a6dde2debfe0efc77c10041e9b02f95ddfe0996d1a6b6d3ad212e00a0f51cfe86cc767f38c5610d9f279b0191d169ddd0f4
-
Filesize
163KB
MD5ede4e0e4f4547b54a24a170161ae4542
SHA17b15b83ebd70c52302e0dea0dea0404026298713
SHA2565411181f4261c8a1b21450ea7376df3d60003b19ad6ad6c6e1fbee2e4b6b8e32
SHA512d602b165419d1c52e612027208e14a6dde2debfe0efc77c10041e9b02f95ddfe0996d1a6b6d3ad212e00a0f51cfe86cc767f38c5610d9f279b0191d169ddd0f4
-
Filesize
163KB
MD5ede4e0e4f4547b54a24a170161ae4542
SHA17b15b83ebd70c52302e0dea0dea0404026298713
SHA2565411181f4261c8a1b21450ea7376df3d60003b19ad6ad6c6e1fbee2e4b6b8e32
SHA512d602b165419d1c52e612027208e14a6dde2debfe0efc77c10041e9b02f95ddfe0996d1a6b6d3ad212e00a0f51cfe86cc767f38c5610d9f279b0191d169ddd0f4
-
Filesize
36KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
68KB
-
-
Filesize
1.6MB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
68KB
-
Filesize
1.6MB