Overview

overview

10

Static

static

10

c9702d33d6...17.exe

windows7-x64

10

c9702d33d6...17.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    115s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2022 12:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c9702d33d65b6b24d32170f461240217.exe

  • Size

    214KB

  • MD5

    c9702d33d65b6b24d32170f461240217

  • SHA1

    aacac19e5153e82e046b07e0c51b039e59bb4f66

  • SHA256

    9155fa1ea8c37176f6d3fc2438ac6217a4ca28ce279b510e9e7c1a89eb0f9800

  • SHA512

    e333a10e7015b978d8c74c7fad5beeaccbcc7e717aa06232f4729d81bc5973e0d72f6d067e5ffc2323ec849b58e1db95005923f37fe0c85fae9f13d54a6e262e

  • SSDEEP

    6144:Ig72OD+LbR4/R/yIoqy9r0wUXXCU/M7dvaUQ/Hw14fZNw:j6Oo5Jr0wU9/oo/GMZi

Score
10/10
systembctrojan

Malware Config

Extracted

Family

systembc

C2

scserv1.info:4077

scserv2.info:4077

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • Executes dropped EXE 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9702d33d65b6b24d32170f461240217.exe
    "C:\Users\Admin\AppData\Local\Temp\c9702d33d65b6b24d32170f461240217.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4076
  • C:\ProgramData\xdvtd\iaiw.exe
    C:\ProgramData\xdvtd\iaiw.exe start2
    1⤵
    • Executes dropped EXE
    PID:1840
  • C:\ProgramData\xdvtd\iaiw.exe
    C:\ProgramData\xdvtd\iaiw.exe start2
    1⤵
    • Executes dropped EXE
    PID:3576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\xdvtd\iaiw.exe
    Filesize

    214KB

    MD5

    c9702d33d65b6b24d32170f461240217

    SHA1

    aacac19e5153e82e046b07e0c51b039e59bb4f66

    SHA256

    9155fa1ea8c37176f6d3fc2438ac6217a4ca28ce279b510e9e7c1a89eb0f9800

    SHA512

    e333a10e7015b978d8c74c7fad5beeaccbcc7e717aa06232f4729d81bc5973e0d72f6d067e5ffc2323ec849b58e1db95005923f37fe0c85fae9f13d54a6e262e

    Download Submit
  • C:\ProgramData\xdvtd\iaiw.exe
    Filesize

    214KB

    MD5

    c9702d33d65b6b24d32170f461240217

    SHA1

    aacac19e5153e82e046b07e0c51b039e59bb4f66

    SHA256

    9155fa1ea8c37176f6d3fc2438ac6217a4ca28ce279b510e9e7c1a89eb0f9800

    SHA512

    e333a10e7015b978d8c74c7fad5beeaccbcc7e717aa06232f4729d81bc5973e0d72f6d067e5ffc2323ec849b58e1db95005923f37fe0c85fae9f13d54a6e262e

    Download Submit
  • C:\ProgramData\xdvtd\iaiw.exe
    Filesize

    214KB

    MD5

    c9702d33d65b6b24d32170f461240217

    SHA1

    aacac19e5153e82e046b07e0c51b039e59bb4f66

    SHA256

    9155fa1ea8c37176f6d3fc2438ac6217a4ca28ce279b510e9e7c1a89eb0f9800

    SHA512

    e333a10e7015b978d8c74c7fad5beeaccbcc7e717aa06232f4729d81bc5973e0d72f6d067e5ffc2323ec849b58e1db95005923f37fe0c85fae9f13d54a6e262e

    Download Submit