Analysis
-
max time kernel
131s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
08-08-2023 09:33
General
-
Target
b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793.dll
-
Size
6.0MB
-
MD5
62813c6cab9234e83949fcc563c33b57
-
SHA1
474c9abc14fea035d0e80128dbd7260f0cbc42b2
-
SHA256
b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793
-
SHA512
a29cdda3218566509cfc3d07b50bfe9ece45fd6a57cb12b649b283204191326e30746bc9d33c63b2e8281b65fd1f19cc79092b81e8cd67d593010c3574986542
-
SSDEEP
98304:Yk/CgBuUFSDyJ6FqBh2Rvtu9+GdULsSuPbm5u1et8yDD27AadUEpnoj:DBumcyJ6O3LdCgPbSket8yDDTsGj
Score
10/10
Malware Config
Extracted
Family
systembc
C2
5.42.65.67:4298
localhost.exchange:4298
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Blocklisted process makes network request 1 IoCs
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.5MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
10.5MB