Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
09-05-2023 04:53
General
-
Target
socks_tor.exe
-
Size
32KB
-
MD5
af6bc46db7a4d4ab3f4689848de18ddc
-
SHA1
5e00ccab03314b6c37a0a16f646fb13b8d1072ab
-
SHA256
c671384b86b7a99d4328402936f51ca9143543f8e6f715c8315e18d2e3c660e6
-
SHA512
81260938cc4b68cd61ed496ba99a873b2abdce7a57f27f9cbdab2acd1e70cade3acb394f0a2da01e4a3935deccf1b4006f550c38c2dbc1c4f2c19ad22a04250c
-
SSDEEP
768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2TZKc6wFg:YLJ8dayaaupDobnpo2wZu
Malware Config
Extracted
systembc
89.248.163.188:443
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\socks_tor.exe"C:\Users\Admin\AppData\Local\Temp\socks_tor.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\evbnsb\mehcf.exeC:\ProgramData\evbnsb\mehcf.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5af6bc46db7a4d4ab3f4689848de18ddc
SHA15e00ccab03314b6c37a0a16f646fb13b8d1072ab
SHA256c671384b86b7a99d4328402936f51ca9143543f8e6f715c8315e18d2e3c660e6
SHA51281260938cc4b68cd61ed496ba99a873b2abdce7a57f27f9cbdab2acd1e70cade3acb394f0a2da01e4a3935deccf1b4006f550c38c2dbc1c4f2c19ad22a04250c
-
Filesize
32KB
MD5af6bc46db7a4d4ab3f4689848de18ddc
SHA15e00ccab03314b6c37a0a16f646fb13b8d1072ab
SHA256c671384b86b7a99d4328402936f51ca9143543f8e6f715c8315e18d2e3c660e6
SHA51281260938cc4b68cd61ed496ba99a873b2abdce7a57f27f9cbdab2acd1e70cade3acb394f0a2da01e4a3935deccf1b4006f550c38c2dbc1c4f2c19ad22a04250c