Analysis
-
max time kernel
378s -
max time network
1797s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
02-03-2023 23:34
General
-
Target
b5ed2d8ade543409aa3ce182dd61a03e.exe
-
Size
1.3MB
-
MD5
b5ed2d8ade543409aa3ce182dd61a03e
-
SHA1
808c2ad2d0ffbb51a353bb7a8a4e6c52bbf8928e
-
SHA256
6779c5bd995a94b8e53173cd3be2e59adcca2f9775674dc681565eef4197627e
-
SHA512
89fcb252d3af7e38d536b67baac5d4eccae7a468cbf2e3381b8453d9a13aa2d556e95b13e352040947d5d62f11c6c60c1d8034dcdb9ebaf04005f144bf1e5e61
-
SSDEEP
24576:eAHnh+eWsN3skA4RV1Hom2KXMmHayQxvgyx7lfsc7du+VAjpT5:Jh+ZkldoPK8Ya3Bgy3fsc7du+V4z
Score
10/10
Malware Config
Extracted
Family
systembc
C2
212.118.36.165:4193
46.151.26.42:4193
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5ed2d8ade543409aa3ce182dd61a03e.exe"C:\Users\Admin\AppData\Local\Temp\b5ed2d8ade543409aa3ce182dd61a03e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2460-127-0x00000000037D1000-0x00000000037D7000-memory.dmpFilesize
24KB
-
memory/2548-122-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2548-123-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2548-125-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2548-126-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB