Analysis
- max time kernel
165s - max time network
256s - platform
windows10-1703_x64 - resource
win10-20230220-en - resource tags
- submitted
06/03/2023, 22:27
General
- Target f65e2dbbc8e81378ad58cef8cfd831dd0ae44be6333bdaf6a84b6f7136338729.exe
- Size 6.6MB
- Sample230306-2dkc7sef4z
- SHA256 f65e2dbbc8e81378ad58cef8cfd831dd0ae44be6333bdaf6a84b6f7136338729
Score
10/10
Malware Config
Extracted
Family
-
systembc
C2
-
79.137.203.32:4289
-
194.87.111.29:4289
Signatures
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f65e2dbbc8e81378ad58cef8cfd831dd0ae44be6333bdaf6a84b6f7136338729.exe"C:\Users\Admin\AppData\Local\Temp\f65e2dbbc8e81378ad58cef8cfd831dd0ae44be6333bdaf6a84b6f7136338729.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3668-119-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3668-120-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/3668-121-0x0000000000E40000-0x0000000000E41000-memory.dmp
memory/3668-122-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/3668-123-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/3668-124-0x0000000002CC0000-0x0000000002CC1000-memory.dmp
memory/3668-125-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
memory/3668-126-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
memory/3668-127-0x0000000000400000-0x0000000000E3E000-memory.dmp