Analysis
-
max time kernel
112s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
06-12-2022 14:10
General
-
Target
b79f16dd30f7111b84ae7543bc7e1b24.exe
-
Size
32KB
-
MD5
b79f16dd30f7111b84ae7543bc7e1b24
-
SHA1
a459391f937c5dc535497c7076711c27535e51fd
-
SHA256
3564c81981f8f09caab954d67afc49d0cc9ecc309e07d4bcf06192908e01fb38
-
SHA512
7cf36570ca33d81185128427fab6a2687b4bac66896823f8704e90bc7bd09ff16039715abb3db167d4dc819efb17819b5d9f0d26e24e8ba3d7258474f9d72965
-
SSDEEP
768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2W1Kc6UFg:YLJ8dayaaupDobnpo2V1K
Malware Config
Extracted
systembc
109.205.214.18:443
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b79f16dd30f7111b84ae7543bc7e1b24.exe"C:\Users\Admin\AppData\Local\Temp\b79f16dd30f7111b84ae7543bc7e1b24.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\lnrfg\gbfwqx.exeC:\ProgramData\lnrfg\gbfwqx.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\lnrfg\gbfwqx.exeFilesize
32KB
MD5b79f16dd30f7111b84ae7543bc7e1b24
SHA1a459391f937c5dc535497c7076711c27535e51fd
SHA2563564c81981f8f09caab954d67afc49d0cc9ecc309e07d4bcf06192908e01fb38
SHA5127cf36570ca33d81185128427fab6a2687b4bac66896823f8704e90bc7bd09ff16039715abb3db167d4dc819efb17819b5d9f0d26e24e8ba3d7258474f9d72965
-
C:\ProgramData\lnrfg\gbfwqx.exeFilesize
32KB
MD5b79f16dd30f7111b84ae7543bc7e1b24
SHA1a459391f937c5dc535497c7076711c27535e51fd
SHA2563564c81981f8f09caab954d67afc49d0cc9ecc309e07d4bcf06192908e01fb38
SHA5127cf36570ca33d81185128427fab6a2687b4bac66896823f8704e90bc7bd09ff16039715abb3db167d4dc819efb17819b5d9f0d26e24e8ba3d7258474f9d72965