Behavioral task
behavioral1
Sample
5be7a71b4cb4c67b5584a6d684c021dcf2a9825f8b7d02f662ea031a991125aa.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5be7a71b4cb4c67b5584a6d684c021dcf2a9825f8b7d02f662ea031a991125aa.exe
Resource
win7-20240220-en
Behavioral task
behavioral3
Sample
5be7a71b4cb4c67b5584a6d684c021dcf2a9825f8b7d02f662ea031a991125aa.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
5be7a71b4cb4c67b5584a6d684c021dcf2a9825f8b7d02f662ea031a991125aa.exe
Resource
win10v2004-20240412-en
General
-
Target
5be7a71b4cb4c67b5584a6d684c021dcf2a9825f8b7d02f662ea031a991125aa
-
Size
32KB
-
MD5
928c496379fe0b55cab34d2cfdad0f23
-
SHA1
82205fd1073cabafe9591cd11223feddc67a9f98
-
SHA256
5be7a71b4cb4c67b5584a6d684c021dcf2a9825f8b7d02f662ea031a991125aa
-
SHA512
cb968a69cee826b7a25d03ca9941a37369c95eb481ca633e3a16a24cb37638a021d9ab95bc5369f8ae95e5adf5c91a5dabcd1413c38639aa7b10df6d38857784
-
SSDEEP
768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2TZKc6zlFg6:YLJ8dayaaupDobnpo2wZGo6
Malware Config
Extracted
systembc
89.248.163.218:443
Signatures
-
Systembc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5be7a71b4cb4c67b5584a6d684c021dcf2a9825f8b7d02f662ea031a991125aa
Files
-
5be7a71b4cb4c67b5584a6d684c021dcf2a9825f8b7d02f662ea031a991125aa.exe windows:4 windows x86 arch:x86
bf0c7df0c054c291d79bd1c72984352c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
CreateWindowExA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
SendMessageA
ShowWindow
TranslateMessage
UpdateWindow
GetWindowTextA
GetMessageA
GetClassNameA
EnumWindows
DispatchMessageA
DefWindowProcA
wsprintfA
kernel32
WaitForSingleObject
WriteFile
VirtualProtect
VirtualFree
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FileTimeToSystemTime
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentVariableA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
OpenProcess
RemoveDirectoryA
SetEvent
VirtualAlloc
Sleep
SystemTimeToFileTime
SetFilePointer
advapi32
CryptExportKey
CryptDestroyKey
CryptAcquireContextA
CryptReleaseContext
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
CryptImportKey
wsock32
htons
inet_addr
inet_ntoa
ioctlsocket
select
send
setsockopt
shutdown
socket
recv
connect
closesocket
WSAStartup
WSACleanup
shell32
CommandLineToArgvW
ws2_32
WSAIoctl
getaddrinfo
freeaddrinfo
ole32
CoCreateInstance
CoUninitialize
CoInitialize
netapi32
NetGetJoinInformation
secur32
GetUserNameExW
InitializeSecurityContextA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExA
QueryContextAttributesA
InitSecurityInterfaceA
crypt32
CryptStringToBinaryA
CryptDecodeObject
psapi
GetModuleFileNameExA
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ