Analysis
- max time kernel
145s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20230831-en - resource tags
- submitted
07/09/2023, 16:47
General
- Target SecuriteInfo.com.Trojan.PackedNET.2321.16566.30312_JC.exe
- Size 576KB
- Sample230907-vap1ysbh5w
- SHA256 8f703dbe94ad3c9bfee41a6b920cd7765f0a948cae9bdf196b080253411a5d23
Malware Config
Extracted
-
systembc
-
mxstat215dm.xyz:4044
-
mxstex725dm.xyz:4044
Signatures
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2321.16566.30312_JC.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2321.16566.30312_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2321.16566.30312_JC.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2321.16566.30312_JC.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2321.16566.30312_JC.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2321.16566.30312_JC.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2468-6-0x0000000005AD0000-0x0000000005B6C000-memory.dmp
memory/2468-10-0x0000000005A20000-0x0000000005A30000-memory.dmp
memory/2468-2-0x0000000005E00000-0x00000000063A4000-memory.dmp
memory/2468-3-0x0000000005850000-0x00000000058E2000-memory.dmp
memory/2468-4-0x0000000005A20000-0x0000000005A30000-memory.dmp
memory/2468-5-0x0000000005820000-0x000000000582A000-memory.dmp
memory/2468-1-0x0000000000DB0000-0x0000000000E46000-memory.dmp
memory/2468-8-0x0000000074C80000-0x0000000075430000-memory.dmp
memory/2468-0-0x0000000074C80000-0x0000000075430000-memory.dmp
memory/2468-9-0x0000000005A20000-0x0000000005A30000-memory.dmp
memory/2468-7-0x0000000005A20000-0x0000000005A30000-memory.dmp
memory/2468-15-0x0000000074C80000-0x0000000075430000-memory.dmp
memory/3156-13-0x0000000000400000-0x0000000000407000-memory.dmp
memory/3156-12-0x0000000000400000-0x0000000000407000-memory.dmp
memory/3156-11-0x0000000000400000-0x0000000000407000-memory.dmp