systembc | wizard[.]cpl

Sharing

Copy URL Twitter E-mail

General

Target

wizard.cpl
Size

16KB
MD5

cac81707eba1be452f548e410275a0ac
SHA1

dd4b3bbd8bf357bbdeeb593e94ff0bf9b5ae19f2
SHA256

2f120d396f71ff9adb8fe11f0b529e8ddea8355837d955fed83bb0ae2a35de84
SHA512

01b6b45ec3c5ef4a0162164dfd69c15b08ed37082778ef97d0f1486bc82b4b1659a90705a4d9be42b9d25c8776e20011845a9f5e4498400b11cf14a3310df8d7
SSDEEP

192:RniGhkfGBpFH+Z0hZ1WW8B52daFX4/PqfZSCG0GGGdWoBrSKja1cDHs:Y/fAeZ0hZwW42doxR3gWoBrtW1c

Score

10^/10

systembc

Malware Config

Extracted

Family

systembc

62.173.140.37:4001

Signatures

Systembc family
systembc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wizard.cpl

Files

wizard.cpl
.dll windows:4 windows x86

ea47177789465ada573c717425469cd1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetWindowTextA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
SendMessageA
ShowWindow
CreateWindowExA
TranslateMessage
UpdateWindow
GetMessageA
GetClassNameA
DispatchMessageA
DefWindowProcA
wsprintfA

kernel32

SetEvent
SetFilePointer
Sleep
RemoveDirectoryA
ResetEvent
OpenProcess
WriteFile
WaitForSingleObject
VirtualFree
VirtualAlloc
CloseHandle
CreateDirectoryA
CreateEventA
CreateFileA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
FileTimeToSystemTime
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentVariableA
GetLastError
GetLocalTime
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
SystemTimeToFileTime

advapi32

GetSidSubAuthority
GetUserNameW
OpenProcessToken
GetTokenInformation

wsock32

htons
inet_addr
inet_ntoa
recv
select
send
setsockopt
shutdown
socket
connect
closesocket
ioctlsocket
WSAStartup
WSACleanup

shell32

CommandLineToArgvW

ws2_32

freeaddrinfo
WSAIoctl
getaddrinfo

ole32

CoUninitialize
CoInitialize
CoCreateInstance

secur32

GetUserNameExW
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExA
InitializeSecurityContextA
QueryContextAttributesA

psapi

GetModuleFileNameExA

Exports

Exports

rundll

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 402B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

ea47177789465ada573c717425469cd1

Headers

File Characteristics

Imports

user32

kernel32

advapi32

wsock32

shell32

ws2_32

ole32

secur32

psapi

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 812B

.reloc Size: 512B - Virtual size: 402B

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 812B

.reloc
Size: 512B - Virtual size: 402B