Analysis

  • max time kernel
    90s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2022, 10:29

General

  • Target

    fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100.exe

  • Size

    218KB

  • MD5

    cdc67700f25eaed1417264c4bdec03d3

  • SHA1

    56639e9414e6ee8394d940d62778475ddf071290

  • SHA256

    fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

  • SHA512

    a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

  • SSDEEP

    3072:ErayULJ3h3C59R+rVZxzAskAGbhAzT69ohOP+L+h7b/MxuCwLgNHCDml:E2yUL1JC4fxUspGbhgT62hO2LC2HCa

Score
10/10

Malware Config

Extracted

Family

systembc

C2

109.205.214.18:443

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100.exe
    "C:\Users\Admin\AppData\Local\Temp\fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 956
      2⤵
      • Program crash
      PID:3048
  • C:\ProgramData\imbhou\lxava.exe
    C:\ProgramData\imbhou\lxava.exe start
    1⤵
    • Executes dropped EXE
    PID:4908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3444 -ip 3444
    1⤵
      PID:4504

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\imbhou\lxava.exe

            Filesize

            218KB

            MD5

            cdc67700f25eaed1417264c4bdec03d3

            SHA1

            56639e9414e6ee8394d940d62778475ddf071290

            SHA256

            fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

            SHA512

            a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

          • C:\ProgramData\imbhou\lxava.exe

            Filesize

            218KB

            MD5

            cdc67700f25eaed1417264c4bdec03d3

            SHA1

            56639e9414e6ee8394d940d62778475ddf071290

            SHA256

            fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

            SHA512

            a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

          • memory/3444-133-0x0000000000568000-0x0000000000578000-memory.dmp

            Filesize

            64KB

          • memory/3444-134-0x0000000002050000-0x0000000002059000-memory.dmp

            Filesize

            36KB

          • memory/3444-135-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB

          • memory/3444-140-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB

          • memory/4908-138-0x0000000000482000-0x0000000000493000-memory.dmp

            Filesize

            68KB

          • memory/4908-139-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB