Analysis
- max time kernel
138s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
10/08/2023, 19:13
General
- Target 7b20822375127aaf2c2ec9d1f07a3007.dll
- Size 5.8MB
- Sample230810-xw3kaagg23
- SHA256 3bc9a13ed11a0da691a2b97ddd52168dbead463fd5371916a1d574184c422a3c
Malware Config
Extracted
-
systembc
-
5.42.65.67:4298
-
localhost.exchange:4298
Signatures
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Blocklisted process makes network request 1 IoCs
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7b20822375127aaf2c2ec9d1f07a3007.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1404-136-0x00007FFA57D90000-0x00007FFA58761000-memory.dmp
memory/1404-137-0x00007FFA75C10000-0x00007FFA75C12000-memory.dmp
memory/1404-138-0x00007FFA75C20000-0x00007FFA75C22000-memory.dmp
memory/1404-139-0x00007FFA75670000-0x00007FFA75672000-memory.dmp
memory/1404-140-0x00007FFA75680000-0x00007FFA75682000-memory.dmp
memory/1404-141-0x00007FFA73560000-0x00007FFA73562000-memory.dmp
memory/1404-142-0x00007FFA73570000-0x00007FFA73572000-memory.dmp
memory/1404-144-0x00007FFA75C30000-0x00007FFA75C32000-memory.dmp
memory/1404-145-0x00007FFA57D90000-0x00007FFA58761000-memory.dmp