Resubmissions

18-04-2024 05:25

240418-f4hreadf5z 10

18-04-2024 05:25

240418-f4fl2scd33 10

18-04-2024 05:25

240418-f4fbaadf5v 10

18-04-2024 05:25

240418-f4edzscd32 10

18-04-2024 05:25

240418-f4dsfscd29 10

Analysis

  • max time kernel
    1802s
  • max time network
    1807s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-04-2024 05:25

General

  • Target

    fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe

  • Size

    121KB

  • MD5

    2140899e877c2bb95f71f77c31e205ce

  • SHA1

    b7322db66f0c4b5a48c10ca3213b899131045d11

  • SHA256

    fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20

  • SHA512

    6856af4f8cb1fceede24360c7e081e6beea701a44b80e6276db719e5cba3b6cf5f7fae8df4ce56852ea34e73dfa4e091a8ac258d1efb596e0d7224b33402fe07

  • SSDEEP

    1536:R7YvZGrzMeJILNJMuxyBye/DB79CTi+Ey7c3Ul4kfQuk2RGiXqp64:KvZ8NSLP60e/FeRhTfXrRGN64

Score
10/10

Malware Config

Extracted

Family

systembc

C2

sdadvert197.com:4044

mexstat128.com:4044

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Executes dropped EXE 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops file in Windows directory 2 IoCs
  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe
    "C:\Users\Admin\AppData\Local\Temp\fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1588
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 924
      2⤵
      • Program crash
      PID:1936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 932
      2⤵
      • Program crash
      PID:3088
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 968
      2⤵
      • Program crash
      PID:4888
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1016,i,4190291444332669241,12594774403502447104,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:8
    1⤵
      PID:3080
    • C:\ProgramData\ixoaktg\neiujoj.exe
      C:\ProgramData\ixoaktg\neiujoj.exe start
      1⤵
      • Executes dropped EXE
      PID:464
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1588 -ip 1588
      1⤵
        PID:4248
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1588 -ip 1588
        1⤵
          PID:3076
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1588 -ip 1588
          1⤵
            PID:3376
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3884,i,4190291444332669241,12594774403502447104,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
            1⤵
              PID:4300

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\ixoaktg\neiujoj.exe

              Filesize

              121KB

              MD5

              2140899e877c2bb95f71f77c31e205ce

              SHA1

              b7322db66f0c4b5a48c10ca3213b899131045d11

              SHA256

              fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20

              SHA512

              6856af4f8cb1fceede24360c7e081e6beea701a44b80e6276db719e5cba3b6cf5f7fae8df4ce56852ea34e73dfa4e091a8ac258d1efb596e0d7224b33402fe07

            • memory/464-13-0x00000000039A0000-0x00000000039A9000-memory.dmp

              Filesize

              36KB

            • memory/464-12-0x0000000003580000-0x0000000003680000-memory.dmp

              Filesize

              1024KB

            • memory/464-14-0x0000000000400000-0x00000000031D1000-memory.dmp

              Filesize

              45.8MB

            • memory/464-19-0x0000000003580000-0x0000000003680000-memory.dmp

              Filesize

              1024KB

            • memory/1588-1-0x0000000003210000-0x0000000003310000-memory.dmp

              Filesize

              1024KB

            • memory/1588-2-0x0000000003360000-0x0000000003369000-memory.dmp

              Filesize

              36KB

            • memory/1588-3-0x0000000000400000-0x00000000031D1000-memory.dmp

              Filesize

              45.8MB

            • memory/1588-11-0x0000000003210000-0x0000000003310000-memory.dmp

              Filesize

              1024KB