Analysis
- max time kernel
120s - max time network
256s - platform
windows7_x64 - resource
win7-20230712-en - resource tags
- submitted
09/08/2023, 03:45
General
- Target b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793.dll
- Size 6.0MB
- Sample230809-ebb8gsae8t
- SHA256 b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793
Malware Config
Extracted
-
systembc
-
5.42.65.67:4298
-
localhost.exchange:4298
Signatures
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Blocklisted process makes network request 1 IoCs
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2572-54-0x0000000076EF0000-0x0000000076EF2000-memory.dmp
memory/2572-57-0x000007FEF4560000-0x000007FEF4FE4000-memory.dmp
memory/2572-56-0x0000000076EF0000-0x0000000076EF2000-memory.dmp
memory/2572-59-0x0000000076EF0000-0x0000000076EF2000-memory.dmp
memory/2572-60-0x0000000076F00000-0x0000000076F02000-memory.dmp
memory/2572-62-0x0000000076F00000-0x0000000076F02000-memory.dmp
memory/2572-64-0x0000000076F00000-0x0000000076F02000-memory.dmp
memory/2572-65-0x0000000076F10000-0x0000000076F12000-memory.dmp
memory/2572-67-0x0000000076F10000-0x0000000076F12000-memory.dmp
memory/2572-69-0x0000000076F10000-0x0000000076F12000-memory.dmp
memory/2572-70-0x0000000076F20000-0x0000000076F22000-memory.dmp
memory/2572-72-0x0000000076F20000-0x0000000076F22000-memory.dmp
memory/2572-74-0x0000000076F20000-0x0000000076F22000-memory.dmp
memory/2572-77-0x000007FEFCD90000-0x000007FEFCD92000-memory.dmp
memory/2572-79-0x000007FEFCD90000-0x000007FEFCD92000-memory.dmp
memory/2572-82-0x000007FEFCDA0000-0x000007FEFCDA2000-memory.dmp
memory/2572-84-0x000007FEFCDA0000-0x000007FEFCDA2000-memory.dmp
memory/2572-85-0x0000000076F30000-0x0000000076F32000-memory.dmp
memory/2572-87-0x0000000076F30000-0x0000000076F32000-memory.dmp
memory/2572-90-0x0000000076D40000-0x0000000076EE9000-memory.dmp
memory/2572-89-0x0000000076F30000-0x0000000076F32000-memory.dmp
memory/2572-91-0x000007FEF4560000-0x000007FEF4FE4000-memory.dmp
memory/2572-92-0x0000000076D40000-0x0000000076EE9000-memory.dmp