Analysis
-
max time kernel
132s -
max time network
257s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
04-03-2023 04:50
General
-
Target
f65e2dbbc8e81378ad58cef8cfd831dd0ae44be6333bdaf6a84b6f7136338729.exe
-
Size
6.6MB
-
MD5
d086940618bcc604f2d17c141f47ae49
-
SHA1
0efa810ab7e78a1ddf00cd3d2abd43b9be2eb837
-
SHA256
f65e2dbbc8e81378ad58cef8cfd831dd0ae44be6333bdaf6a84b6f7136338729
-
SHA512
9e4e02bb56580bb55a208f68204860fe64617537b4450cc5b513c14cacec17ca80a58f432a98c4a9bf2d38014c4826e6e17a5cf919638ac2e4bc823507af2e04
-
SSDEEP
196608:O3mUa51xxehaJ9a1m2asYgqnsKmQUcuJOkoDCNztN:O233xxEaLOYnsKmxQpE3
Score
10/10
Malware Config
Extracted
Family
systembc
C2
79.137.203.32:4289
194.87.111.29:4289
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f65e2dbbc8e81378ad58cef8cfd831dd0ae44be6333bdaf6a84b6f7136338729.exe"C:\Users\Admin\AppData\Local\Temp\f65e2dbbc8e81378ad58cef8cfd831dd0ae44be6333bdaf6a84b6f7136338729.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.2MB