Resubmissions
18-04-2024 11:16
240418-ndcfpscf5y 1018-04-2024 11:16
240418-ndbt6sbd39 1018-04-2024 11:16
240418-ndaxwacf5v 1018-04-2024 11:16
240418-nc6m6acf41 1018-04-2024 11:16
240418-nc52mabd37 1018-04-2024 09:58
240418-lztk1ahg62 10Analysis
-
max time kernel
599s -
max time network
603s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
18-04-2024 11:16
General
-
Target
81d1e936a8f817e01344049ce63b41e968fec7b265c9d2ab6678412904f15178.exe
-
Size
224KB
-
MD5
dceece60dcee5fd4d47755d6b3a85a75
-
SHA1
6969cc2f1939fd4373a83a2e607318e2cf7d78aa
-
SHA256
81d1e936a8f817e01344049ce63b41e968fec7b265c9d2ab6678412904f15178
-
SHA512
da5c40491463e6cd94486d06ccda76a7eaf15fdb04e1015b6ec24d8f023ec06a91115b309e7d144aa628b93a634e2b79ea6421a8708c9b837c6a3c43ac38ef7f
-
SSDEEP
3072:/kHyNZCT7RbVv513b2cLrEJeGUDL61UNmUCFh9W8Nf3IAK9EjCcak+OWgY5:VCTh/V3DeewB93I/+UOXC
Malware Config
Extracted
systembc
149.248.34.200:4001
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81d1e936a8f817e01344049ce63b41e968fec7b265c9d2ab6678412904f15178.exe"C:\Users\Admin\AppData\Local\Temp\81d1e936a8f817e01344049ce63b41e968fec7b265c9d2ab6678412904f15178.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
-
Filesize
52KB
-
Filesize
40KB