Behavioral task
behavioral1
Sample
f78838ebfb2daee5b73539e01e7b12b729d79a4c302ba74ad8cf4b0c8927998d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f78838ebfb2daee5b73539e01e7b12b729d79a4c302ba74ad8cf4b0c8927998d.exe
Resource
win10v2004-20240508-en
General
-
Target
f78838ebfb2daee5b73539e01e7b12b729d79a4c302ba74ad8cf4b0c8927998d
-
Size
15KB
-
MD5
c93b64fd792a3a3292486fe318220171
-
SHA1
0e63ce75c4e96bb41c5d9d99cda6c27c9c86a04c
-
SHA256
f78838ebfb2daee5b73539e01e7b12b729d79a4c302ba74ad8cf4b0c8927998d
-
SHA512
4977845dd4373807efa2e034275b4db7e54566d7d4428b9c4164fa98426fc92a7d3a88a15e5e27e4dd43a8db64c9be79d7c6090e8eb2e517444063a274bc1562
-
SSDEEP
384:8/wK8VcHXC3pA/ZbdrJXNcQbvZWXhphZBZRICEo:se2XJBbxJXZchph5GCV
Malware Config
Extracted
systembc
91.103.252.89:4317
91.103.252.57:4317
Signatures
-
Systembc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f78838ebfb2daee5b73539e01e7b12b729d79a4c302ba74ad8cf4b0c8927998d
Files
-
f78838ebfb2daee5b73539e01e7b12b729d79a4c302ba74ad8cf4b0c8927998d.exe windows:4 windows x86 arch:x86
3a0233c129f2514486a242d7d5874037
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
LoadCursorA
LoadIconA
PostQuitMessage
RegisterClassA
ShowWindow
TranslateMessage
UpdateWindow
wsprintfA
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
kernel32
WaitForSingleObject
WriteFile
SetFilePointer
VirtualFree
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
CreateThread
ExitProcess
FileTimeToSystemTime
GetCommandLineA
GetCurrentProcess
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
SetEvent
VirtualAlloc
Sleep
SystemTimeToFileTime
advapi32
RegOpenKeyExA
GetTokenInformation
OpenProcessToken
RegCloseKey
RegSetValueExA
GetSidSubAuthority
RegDeleteValueA
RegCreateKeyExA
wsock32
closesocket
connect
inet_addr
inet_ntoa
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
htons
WSAStartup
ws2_32
freeaddrinfo
WSAIoctl
getaddrinfo
ole32
CoUninitialize
CoInitialize
CoCreateInstance
secur32
GetUserNameExA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExW
QueryContextAttributesA
InitializeSecurityContextA
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 370B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ