Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
15/04/2024, 11:39
240415-nshk9sdd73 1015/04/2024, 11:39
240415-nshahafg41 1015/04/2024, 11:39
240415-nsgnzadd72 1015/04/2024, 11:39
240415-nsf3fadd69 1015/04/2024, 11:39
240415-nsffxadd68 1010/04/2024, 05:03
240410-fpndcadd29 1010/04/2024, 05:02
240410-fph4madd28 1010/04/2024, 05:02
240410-fphsvsge5z 1010/04/2024, 05:02
240410-fphg4age5y 1008/02/2023, 19:06
230208-xr3z9aef82 10Analysis
-
max time kernel
593s -
max time network
600s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
10/04/2024, 05:03
General
-
Target
2579be109c1035cb96942951710020a8.exe
-
Size
147KB
-
MD5
2579be109c1035cb96942951710020a8
-
SHA1
6987472967c8ce5e3d5fd6730a9da2964afacd10
-
SHA256
a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101
-
SHA512
191ea3d7edc69f1cb9d1ec4967074667c5e1c6b02fdaa8bbc5a4414bf5ca00ccafadc49670c5b3065133915d78e482572545f1d0c8c3382e6a767c1f08a33a21
-
SSDEEP
3072:9NuSXw/c4JHdNX8PAzCABaxg0r27f8EjQspDNJJAksa:9oSXw/hfNXmAzbYg02Ok
Malware Config
Extracted
systembc
advertspace10.club:4044
logstat17.club:4044
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2579be109c1035cb96942951710020a8.exe"C:\Users\Admin\AppData\Local\Temp\2579be109c1035cb96942951710020a8.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\cooccc\pvcard.exeC:\ProgramData\cooccc\pvcard.exe start21⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147KB
MD52579be109c1035cb96942951710020a8
SHA16987472967c8ce5e3d5fd6730a9da2964afacd10
SHA256a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101
SHA512191ea3d7edc69f1cb9d1ec4967074667c5e1c6b02fdaa8bbc5a4414bf5ca00ccafadc49670c5b3065133915d78e482572545f1d0c8c3382e6a767c1f08a33a21
-
Filesize
208KB
-
Filesize
4KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
4KB
-
Filesize
208KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB