systembc | CA36AD5442865E4B9571C82CE7B5BFE7[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
CA36AD5442865E4B9571C82CE7B5BFE7.exe
Size 16KB
Sample240213-tmqbtadh68
SHA256 28135bb818682c71869768c1105e91595367c2f633c6e68b8c2ccb8611911972
MD5 ca36ad5442865e4b9571c82ce7b5bfe7
SHA1 b0b8795eb15b7986484c9f979c9d440f73b482e4
SHA512 50d702c68aa82d50a4b0f1a455f0a05c3d5eaa69ebe88fd001bfb349169fe1902be93ae282b5cdc650865fcdd91c5267fe6c9324da45dd14b467ea6854e13f1f
SSDEEP 384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dVJ3uM9s:r0gklrydgQP1yO67VJ3uMm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc

Malware Config

Extracted

Family

systembc

45.140.147.91:4001

Signatures

Systembc family
systembc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CA36AD5442865E4B9571C82CE7B5BFE7.exe

File Explorer

CA36AD5442865E4B9571C82CE7B5BFE7.exe

.exe 16KB

CA36AD5442865E4B9571C82CE7B5BFE7.exe

IMPHASH b83b4c7be0b1cdd8e117bba9096d9768
SHA256 28135bb818682c71869768c1105e91595367c2f633c6e68b8c2ccb8611911972
MD5 ca36ad5442865e4b9571c82ce7b5bfe7
SHA1 b0b8795eb15b7986484c9f979c9d440f73b482e4
SHA512 50d702c68aa82d50a4b0f1a455f0a05c3d5eaa69ebe88fd001bfb349169fe1902be93ae282b5cdc650865fcdd91c5267fe6c9324da45dd14b467ea6854e13f1f
SSDEEP 384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dVJ3uM9s:r0gklrydgQP1yO67VJ3uMm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetMessageA GetWindowTextA GetWindowThreadProcessId LoadCursorA LoadIconA CreateWindowExA RegisterClassA SendMessageA ShowWindow TranslateMessage UpdateWindow GetClassNameA EnumWindows DispatchMessageA DefWindowProcA wsprintfA

kernel32

ResetEvent SetEvent SetFilePointer OpenProcess RemoveDirectoryA LocalAlloc WriteFile WaitForSingleObject VirtualFree VirtualAlloc SystemTimeToFileTime CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateMutexA CreateThread CreateToolhelp32Snapshot DeleteFileA ExitProcess FileTimeToSystemTime GetCommandLineW GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableA GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetTempPathA GetVolumeInformationA LocalFree Sleep

advapi32

GetSidSubAuthority GetUserNameW OpenProcessToken GetTokenInformation

wsock32

htons inet_addr inet_ntoa recv select send setsockopt shutdown socket connect closesocket ioctlsocket WSAStartup WSACleanup

shell32

CommandLineToArgvW

ws2_32

freeaddrinfo WSAIoctl getaddrinfo

ole32

CoUninitialize CoInitialize CoCreateInstance

secur32

GetUserNameExW QueryContextAttributesA AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle GetUserNameExA InitializeSecurityContextA

psapi

GetModuleFileNameExA