Analysis
- max time kernel
202s - max time network
259s - platform
windows10-1703_x64 - resource
win10-20230703-en - resource tags
- submitted
30/07/2023, 04:48
General
- Target 2beeb1e24561fd6ed03890da0afa68e0120776b815f5c60350e06e1d54562f9e.dll
- Size 6.0MB
- Sample230730-ffed3sgb25
- SHA256 2beeb1e24561fd6ed03890da0afa68e0120776b815f5c60350e06e1d54562f9e
Malware Config
Extracted
-
systembc
-
5.42.65.67:4298
-
localhost.exchange:4298
Signatures
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Blocklisted process makes network request 1 IoCs
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2beeb1e24561fd6ed03890da0afa68e0120776b815f5c60350e06e1d54562f9e.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4340-118-0x00007FFDB2FC0000-0x00007FFDB3A0E000-memory.dmp
memory/4340-117-0x00007FFDCEF90000-0x00007FFDCEF92000-memory.dmp
memory/4340-119-0x00007FFDCEFA0000-0x00007FFDCEFA2000-memory.dmp
memory/4340-121-0x00007FFDCD870000-0x00007FFDCD872000-memory.dmp
memory/4340-120-0x00007FFDCD860000-0x00007FFDCD862000-memory.dmp
memory/4340-123-0x00007FFDCB5F0000-0x00007FFDCB5F2000-memory.dmp
memory/4340-122-0x00007FFDCB5E0000-0x00007FFDCB5E2000-memory.dmp
memory/4340-125-0x00007FFDCEFB0000-0x00007FFDCEFB2000-memory.dmp
memory/4340-126-0x00007FFDB2FC0000-0x00007FFDB3A0E000-memory.dmp