Analysis
- max time kernel
142s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
04/08/2023, 14:26
General
- Target 3c259a269cfbb752ca15046aca1bea4a31390e4674de632c5c9428e95b41db1dexe_JC.dll
- Size 5.8MB
- Sample230804-rr57qacd9s
- SHA256 3c259a269cfbb752ca15046aca1bea4a31390e4674de632c5c9428e95b41db1d
Malware Config
Extracted
-
systembc
-
5.42.65.67:4298
-
localhost.exchange:4298
Signatures
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Blocklisted process makes network request 1 IoCs
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c259a269cfbb752ca15046aca1bea4a31390e4674de632c5c9428e95b41db1dexe_JC.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2604-134-0x00007FF903C90000-0x00007FF904658000-memory.dmp
memory/2604-133-0x00007FF921850000-0x00007FF921852000-memory.dmp
memory/2604-135-0x00007FF921860000-0x00007FF921862000-memory.dmp
memory/2604-136-0x00007FF920190000-0x00007FF920192000-memory.dmp
memory/2604-137-0x00007FF9201A0000-0x00007FF9201A2000-memory.dmp
memory/2604-138-0x00007FF91F670000-0x00007FF91F672000-memory.dmp
memory/2604-139-0x00007FF91F680000-0x00007FF91F682000-memory.dmp
memory/2604-140-0x00007FF921870000-0x00007FF921872000-memory.dmp
memory/2604-141-0x00007FF903C90000-0x00007FF904658000-memory.dmp
memory/2604-142-0x000001DB5FB30000-0x000001DB5FC45000-memory.dmp