Analysis
- max time kernel
203s - max time network
254s - platform
windows10-1703_x64 - resource
win10-20230703-en - resource tags
- submitted
05/08/2023, 03:54
General
- Target 11f88c287b501abb341631221d59ef63089baa83faecbf222c3ba618e5f49456.dll
- Size 6.4MB
- Sample230805-ef76qafe96
- SHA256 11f88c287b501abb341631221d59ef63089baa83faecbf222c3ba618e5f49456
Malware Config
Extracted
-
systembc
-
5.42.65.67:4298
-
localhost.exchange:4298
Signatures
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Blocklisted process makes network request 1 IoCs
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\11f88c287b501abb341631221d59ef63089baa83faecbf222c3ba618e5f49456.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1100-119-0x00007FF943CD0000-0x00007FF9447E2000-memory.dmp
memory/1100-120-0x00007FF95FD60000-0x00007FF95FD62000-memory.dmp
memory/1100-118-0x00007FF95FD50000-0x00007FF95FD52000-memory.dmp
memory/1100-121-0x00007FF95ECE0000-0x00007FF95ECE2000-memory.dmp
memory/1100-122-0x00007FF95ECF0000-0x00007FF95ECF2000-memory.dmp
memory/1100-123-0x00007FF95C460000-0x00007FF95C462000-memory.dmp
memory/1100-124-0x00007FF95C470000-0x00007FF95C472000-memory.dmp
memory/1100-126-0x00007FF95FD70000-0x00007FF95FD72000-memory.dmp
memory/1100-127-0x00007FF943CD0000-0x00007FF9447E2000-memory.dmp