Resubmissions

17-04-2024 12:47

240417-p1aq3ahc4w 10

17-04-2024 12:47

240417-pz95jafg23 10

17-04-2024 12:47

240417-pz9h1afg22 10

17-04-2024 12:46

240417-pz56ksff97 10

17-04-2024 12:46

240417-pz49aahc3t 10

17-04-2024 06:16

240417-g1qhhsff94 10

Analysis

  • max time kernel
    299s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17-04-2024 12:46

General

  • Target

    09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe

  • Size

    221KB

  • MD5

    364d59e179ebcd469dce4f231789732d

  • SHA1

    bc86ba43147fe0d301a32b66193dd2930b8af1d2

  • SHA256

    09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc

  • SHA512

    92ae882cb803b23dc344a42b07ffcc77999f71dcd6b7bf1d2ca7e7306a7642543a2cc85f2bdf18df67151a8b2145509363b2552d4e5361715bc55b934db046fe

  • SSDEEP

    6144:0YlvDFWQtzoa2gUayZSSnBcaa5MKmtVgykK:BNtzPqUgkNM4

Score
10/10

Malware Config

Extracted

Family

systembc

C2

yan0212.com:4039

yan0212.net:4039

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
    "C:\Users\Admin\AppData\Local\Temp\09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3988
  • C:\ProgramData\aegkmoq\twisf.exe
    C:\ProgramData\aegkmoq\twisf.exe start
    1⤵
    • Executes dropped EXE
    PID:1112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\aegkmoq\twisf.exe

    Filesize

    221KB

    MD5

    364d59e179ebcd469dce4f231789732d

    SHA1

    bc86ba43147fe0d301a32b66193dd2930b8af1d2

    SHA256

    09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc

    SHA512

    92ae882cb803b23dc344a42b07ffcc77999f71dcd6b7bf1d2ca7e7306a7642543a2cc85f2bdf18df67151a8b2145509363b2552d4e5361715bc55b934db046fe

  • memory/1112-8-0x0000000005010000-0x0000000005019000-memory.dmp

    Filesize

    36KB

  • memory/1112-10-0x0000000000400000-0x0000000004C6C000-memory.dmp

    Filesize

    72.4MB

  • memory/3988-1-0x0000000004DE0000-0x0000000004DE9000-memory.dmp

    Filesize

    36KB

  • memory/3988-0-0x0000000004C90000-0x0000000004C96000-memory.dmp

    Filesize

    24KB

  • memory/3988-7-0x0000000000400000-0x0000000004C6C000-memory.dmp

    Filesize

    72.4MB