Behavioral task
behavioral1
Sample
801e8398ca3e490bdff9a99a38fa4af6f71c5bf88d0c323bf2e3ac2b47abeaf7.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
801e8398ca3e490bdff9a99a38fa4af6f71c5bf88d0c323bf2e3ac2b47abeaf7.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
801e8398ca3e490bdff9a99a38fa4af6f71c5bf88d0c323bf2e3ac2b47abeaf7.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
801e8398ca3e490bdff9a99a38fa4af6f71c5bf88d0c323bf2e3ac2b47abeaf7.exe
Resource
win10v2004-20240412-en
General
-
Target
801e8398ca3e490bdff9a99a38fa4af6f71c5bf88d0c323bf2e3ac2b47abeaf7
-
Size
32KB
-
MD5
c6855dd4b90721873f95fbc733b2510e
-
SHA1
43f23de4e23212f82ef728ae9b44becce19421fe
-
SHA256
801e8398ca3e490bdff9a99a38fa4af6f71c5bf88d0c323bf2e3ac2b47abeaf7
-
SHA512
d959e07c75ed2547ddd0d0de0c99dbfa44db3047eced74524e6cba3882867123cfd1d8ec731f1f089c542280f533104a3738c937150cca4c9e8990d076611d08
-
SSDEEP
768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2TZKc6zlFg/:YLJ8dayaaupDobnpo2wZGo/
Malware Config
Extracted
systembc
89.248.163.218:443
Signatures
-
Systembc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 801e8398ca3e490bdff9a99a38fa4af6f71c5bf88d0c323bf2e3ac2b47abeaf7
Files
-
801e8398ca3e490bdff9a99a38fa4af6f71c5bf88d0c323bf2e3ac2b47abeaf7.exe windows:4 windows x86 arch:x86
bf0c7df0c054c291d79bd1c72984352c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
CreateWindowExA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
SendMessageA
ShowWindow
TranslateMessage
UpdateWindow
GetWindowTextA
GetMessageA
GetClassNameA
EnumWindows
DispatchMessageA
DefWindowProcA
wsprintfA
kernel32
WaitForSingleObject
WriteFile
VirtualProtect
VirtualFree
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FileTimeToSystemTime
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentVariableA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
OpenProcess
RemoveDirectoryA
SetEvent
VirtualAlloc
Sleep
SystemTimeToFileTime
SetFilePointer
advapi32
CryptExportKey
CryptDestroyKey
CryptAcquireContextA
CryptReleaseContext
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
CryptImportKey
wsock32
htons
inet_addr
inet_ntoa
ioctlsocket
select
send
setsockopt
shutdown
socket
recv
connect
closesocket
WSAStartup
WSACleanup
shell32
CommandLineToArgvW
ws2_32
WSAIoctl
getaddrinfo
freeaddrinfo
ole32
CoCreateInstance
CoUninitialize
CoInitialize
netapi32
NetGetJoinInformation
secur32
GetUserNameExW
InitializeSecurityContextA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExA
QueryContextAttributesA
InitSecurityInterfaceA
crypt32
CryptStringToBinaryA
CryptDecodeObject
psapi
GetModuleFileNameExA
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ