Behavioral task
behavioral1
Sample
722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe
Resource
win10v2004-20240412-en
General
-
Target
722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287
-
Size
856KB
-
MD5
f7d59f44fee4981011624cfad18f5337
-
SHA1
db1cb01bfb123b2f5fb1240d57f263573d90433f
-
SHA256
722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287
-
SHA512
633774cda15ad084b8aa6cdde1783450c3bafdfb744cf3e79066632e785261f93e520b5a0f346623727f2158f562b691ab16b0e55bc209f364414843df929965
-
SSDEEP
1536:ysXQ0yVN2gV0GnoX1kPYqwtFUNn0WJWsa9tjUQukOVRct3Z3zAtp:xQX2gV1lwqaFFF9tjUXfVRo
Malware Config
Extracted
systembc
asdasd08.com:4039
asdasd08.xyz:4039
Signatures
-
Systembc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287
Files
-
722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe windows:4 windows x86 arch:x86
7530baea89bb7f06c2456714a05745a0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetMessageA
GetWindowTextA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
SendMessageA
ShowWindow
TranslateMessage
UpdateWindow
wsprintfA
GetClassNameA
EnumWindows
DispatchMessageA
DefWindowProcA
CreateWindowExA
kernel32
WaitForSingleObject
WriteFile
VirtualFree
VirtualProtect
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FileTimeToSystemTime
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentVariableA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
OpenProcess
RemoveDirectoryA
VirtualAlloc
SetFilePointer
Sleep
SystemTimeToFileTime
SetEvent
advapi32
CryptAcquireContextA
CryptExportKey
CryptImportKey
CryptReleaseContext
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
CryptDestroyKey
wsock32
htons
inet_addr
inet_ntoa
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
connect
closesocket
WSAStartup
WSACleanup
shell32
CommandLineToArgvW
ws2_32
freeaddrinfo
WSAIoctl
getaddrinfo
ole32
CoUninitialize
CoInitialize
CoCreateInstance
secur32
GetUserNameExA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
QueryContextAttributesA
GetUserNameExW
InitSecurityInterfaceA
InitializeSecurityContextA
crypt32
CryptStringToBinaryA
CryptDecodeObject
psapi
GetModuleFileNameExA
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 690B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ