Analysis
-
max time kernel
171s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
09-02-2023 08:19
General
-
Target
6f21ef2acc3d9b4bb18800d61c61b2f4.exe
-
Size
827KB
-
MD5
6f21ef2acc3d9b4bb18800d61c61b2f4
-
SHA1
d176b38b567ce050c82ecb8b0e4e8cc44a7ea0e4
-
SHA256
1bd1c5a709b98d3b13c3cb3572c1c409334807a05257555e8c11f7ddc0d17e36
-
SHA512
45051de1630858e982b0a5050700b8dde734fa5e04d95720abaa137433d6a8239a15187638d88c0697d73641136248a9cace5f001eba4f744899da619ea90033
-
SSDEEP
1536:rvG6I+Lt6Pzw6u75dXWeBvfkkcCxauMjx2CaVcG15I4bzWXtmEQ:rvG6I+LUc6ul11cSkj8Rh15I417
Malware Config
Extracted
systembc
inredrs5er.xyz:4116
s5s4txirgtrtin.com:4116
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f21ef2acc3d9b4bb18800d61c61b2f4.exe"C:\Users\Admin\AppData\Local\Temp\6f21ef2acc3d9b4bb18800d61c61b2f4.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\gxlbeg\elpgwx.exeC:\ProgramData\gxlbeg\elpgwx.exe start21⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
827KB
MD56f21ef2acc3d9b4bb18800d61c61b2f4
SHA1d176b38b567ce050c82ecb8b0e4e8cc44a7ea0e4
SHA2561bd1c5a709b98d3b13c3cb3572c1c409334807a05257555e8c11f7ddc0d17e36
SHA51245051de1630858e982b0a5050700b8dde734fa5e04d95720abaa137433d6a8239a15187638d88c0697d73641136248a9cace5f001eba4f744899da619ea90033
-
Filesize
827KB
MD56f21ef2acc3d9b4bb18800d61c61b2f4
SHA1d176b38b567ce050c82ecb8b0e4e8cc44a7ea0e4
SHA2561bd1c5a709b98d3b13c3cb3572c1c409334807a05257555e8c11f7ddc0d17e36
SHA51245051de1630858e982b0a5050700b8dde734fa5e04d95720abaa137433d6a8239a15187638d88c0697d73641136248a9cace5f001eba4f744899da619ea90033
-
Filesize
88KB
-
Filesize
848KB
-
Filesize
88KB