Analysis
- max time kernel
292s - max time network
303s - platform
windows10-1703_x64 - resource
win10-20230703-en - resource tags
- submitted
20/07/2023, 03:38
General
- Target 8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe
- Size 4.8MB
- Sample230720-d65b3sce72
- SHA256 8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92
Score
10/10
Malware Config
Extracted
Family
-
systembc
C2
-
91.103.252.89:4317
-
91.103.252.57:4317
Signatures
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe"C:\Users\Admin\AppData\Local\Temp\8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\cwtiwn.exeC:\Users\Admin\AppData\Local\Temp\cwtiwn.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
cwtiwn.exe
cwtiwn.exe
memory/3012-144-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3012-146-0x0000000000400000-0x00000000008D6000-memory.dmp
memory/3012-147-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3012-148-0x0000000000400000-0x00000000008D6000-memory.dmp
memory/4448-117-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4448-118-0x0000000000400000-0x00000000008D6000-memory.dmp
memory/4448-119-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4448-120-0x00000000044D0000-0x0000000004919000-memory.dmp
memory/4448-121-0x0000000000400000-0x00000000008D6000-memory.dmp