Analysis
-
max time kernel
90s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-12-2022 08:17
General
-
Target
2f781ea76036a17bbd0c0f63be7cff12.dll
-
Size
6.4MB
-
MD5
2f781ea76036a17bbd0c0f63be7cff12
-
SHA1
b9b4c756949a038e87f4efd3569ba12c41a8e810
-
SHA256
3acc979360b4496d3557182148b005a36f5334ea1b7efc42095c85aa0bf64372
-
SHA512
c2b89d8be8438b9234a4cfeee4bd46535ec15dbf599c7553b957f0d3a8703fbd9dada2d2baa3b1a25b2bc58907f6db2f271d9d1926cac89d69912fb9e4f83208
-
SSDEEP
98304:/B853MGVQj4NoTQPxpl8SDI79SIcEj2gLmtGFG4nFDwAEtPqJkqdw6bDQ/:pIcGKeDxplo9F5LBFpMtiJkk8
Score
10/10
Malware Config
Extracted
Family
systembc
C2
89.22.236.225:4193
176.124.205.5:4193
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Blocklisted process makes network request 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f781ea76036a17bbd0c0f63be7cff12.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-132-0x00007FFF96480000-0x00007FFF96E7D000-memory.dmpFilesize
10.0MB