Analysis
-
max time kernel
143s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2023 11:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
s64com.dll
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
General
-
Target
s64com.dll
-
Size
6.4MB
-
MD5
cb44d16ebac295a75245dce05a75997b
-
SHA1
101cc9e8df36e1e7061f449a84109d1d75e6f8ae
-
SHA256
313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355
-
SHA512
a21a09fe60dd4380fdb9fbbeee0e6f0c543a8182aa6b3be5e77306928222c90bdd27b6dc2a1f54f31a5ba3c0322914a36c009773f30f9b94c4246110254bbb4b
-
SSDEEP
196608:r/Ux5R45q2JoGqtQLHTE/+667kFiQwI99:Ai5q2yXtaU+6U7I
Malware Config
Extracted
Family
systembc
C2
5.42.65.67:4298
localhost.exchange:4298
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 20 4172 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4172 rundll32.exe 4172 rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4172-133-0x00007FFCB4C90000-0x00007FFCB5714000-memory.dmpFilesize
10.5MB
-
memory/4172-135-0x00007FFCD2DD0000-0x00007FFCD2DD2000-memory.dmpFilesize
8KB
-
memory/4172-136-0x00007FFCD2DE0000-0x00007FFCD2DE2000-memory.dmpFilesize
8KB
-
memory/4172-137-0x00007FFCD2DF0000-0x00007FFCD2DF2000-memory.dmpFilesize
8KB
-
memory/4172-139-0x00007FFCD2AE0000-0x00007FFCD2AE2000-memory.dmpFilesize
8KB
-
memory/4172-138-0x00007FFCD2AD0000-0x00007FFCD2AD2000-memory.dmpFilesize
8KB
-
memory/4172-140-0x00007FFCD0A30000-0x00007FFCD0A32000-memory.dmpFilesize
8KB
-
memory/4172-141-0x00007FFCD0A40000-0x00007FFCD0A42000-memory.dmpFilesize
8KB
-
memory/4172-142-0x00007FFCB4C90000-0x00007FFCB5714000-memory.dmpFilesize
10.5MB