Analysis
- max time kernel
149s - max time network
152s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
26/01/2024, 11:57
General
- Target d7cd8a0d0003d4d6fb0e9b47b5661739fe1b9e8280643c223d7537a07ad1343a.exe
- Size 384KB
- Sample240126-n4mpcsdad3
- SHA256 56085286d9e9210e0a7d33c89f1e08f448e5961b59e3b228c8ef7b777272625b
Malware Config
Extracted
-
systembc
-
mdadvertx17.xyz:4044
-
pkspacex19.xyz:4044
Signatures
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7cd8a0d0003d4d6fb0e9b47b5661739fe1b9e8280643c223d7537a07ad1343a.exe"C:\Users\Admin\AppData\Local\Temp\d7cd8a0d0003d4d6fb0e9b47b5661739fe1b9e8280643c223d7537a07ad1343a.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {20E2DDCF-EC3B-4C66-8EA5-B2B84678E8D3} S-1-5-21-1268429524-3929314613-1992311491-1000:XBTLDBHN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\kkju\nadbwmw.exeC:\ProgramData\kkju\nadbwmw.exe start22⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
nadbwmw.exe
memory/556-24-0x0000000000400000-0x0000000000464000-memory.dmp
memory/556-23-0x0000000000400000-0x0000000000464000-memory.dmp
memory/556-22-0x0000000002030000-0x0000000002038000-memory.dmp
memory/556-20-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/556-19-0x0000000074741000-0x0000000074742000-memory.dmp
memory/2472-3-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2472-6-0x0000000000400000-0x0000000000464000-memory.dmp
memory/2472-5-0x0000000000400000-0x0000000000464000-memory.dmp
memory/2472-4-0x0000000001F10000-0x0000000001F18000-memory.dmp
memory/2472-0-0x0000000000400000-0x0000000000464000-memory.dmp
memory/2472-2-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2472-1-0x0000000073DF1000-0x0000000073DF2000-memory.dmp