systembc | 902337bbf17ac4e015e03d12e79b60b8dd5a8362496da3291a39e9124c58d9ff

General

Target

lrthijawd.exe
Size

898KB
MD5

1b1ecd323162c054864b63ada693cd71
SHA1

333a67545a5d1aad4d73a3501f7152b4529b6b3e
SHA256

902337bbf17ac4e015e03d12e79b60b8dd5a8362496da3291a39e9124c58d9ff
SHA512

f1776b6a457108f10ca940ce02ce98b73404f5cf18fccee4977024cfaf74d7f48666d4da9be1bee27531525e276cb8cfadba39b0c81e0fd8cbe42f7672f45b71
SSDEEP

24576:juDXTIGaPhEYzUzA0amuDXTIGaPhEYzUzA0bnl:KDjlabwz9aDjlabwz9rl

Score

10^/10

systembc trojan

Malware Config

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 38 IoCs

Processes:

work.exejergs.exeddmgw.exeddmgw.exeddmgw.exeddmgw.exekwjtgxk.exework.exework.exekwjtgxk.exework.exejergs.exework.exejergs.exelcot.exework.exejergs.exemnku.exework.exejergs.exeantlagm.exejergs.exejergs.exejergs.exework.exejergs.exework.exejergs.exework.exejergs.exevcsl.exework.exejergs.exespfs.exework.exejergs.exework.exejergs.exe

pid	process
2652	work.exe
1284	jergs.exe
2452	ddmgw.exe
1232	ddmgw.exe
2928	ddmgw.exe
2088	ddmgw.exe
584	kwjtgxk.exe
1632	work.exe
712	work.exe
2516	kwjtgxk.exe
2184	work.exe
1872	jergs.exe
2828	work.exe
644	jergs.exe
2704	lcot.exe
1916	work.exe
576	jergs.exe
856	mnku.exe
320	work.exe
1040	jergs.exe
1720	antlagm.exe
1976	jergs.exe
764	jergs.exe
2528	jergs.exe
2820	work.exe
1684	jergs.exe
2628	work.exe
2604	jergs.exe
1212	work.exe
1752	jergs.exe
1060	vcsl.exe
1036	work.exe
3068	jergs.exe
780	spfs.exe
1708	work.exe
2472	jergs.exe
2480	work.exe
2280	jergs.exe

Loads dropped DLL 42 IoCs

Processes:

cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

pid	process
1340	cmd.exe
1216
1216
1216
1216
1216
1216
1216
1216
1216
1216
1216
2748	cmd.exe
1412	cmd.exe
1232	cmd.exe
1236	cmd.exe
1216
1216
1216
1216
1216
1216
1216
1216
3012	cmd.exe
2504	cmd.exe
1872	cmd.exe
1216
1216
1216
1216
1672	cmd.exe
1216
1216
1216
1216
1216
1216
1216
1216
1672	cmd.exe
1672	cmd.exe

Drops file in Windows directory 14 IoCs

Processes:

jergs.exejergs.exejergs.exejergs.exejergs.exeddmgw.exejergs.exe

description	ioc	process
File created	C:\Windows\Tasks\lcot.job	jergs.exe
File opened for modification	C:\Windows\Tasks\lcot.job	jergs.exe
File opened for modification	C:\Windows\Tasks\mnku.job	jergs.exe
File created	C:\Windows\Tasks\ddmgw.job	jergs.exe
File created	C:\Windows\Tasks\vcsl.job	jergs.exe
File opened for modification	C:\Windows\Tasks\spfs.job	jergs.exe
File opened for modification	C:\Windows\Tasks\ddmgw.job	jergs.exe
File created	C:\Windows\Tasks\kwjtgxk.job	ddmgw.exe
File created	C:\Windows\Tasks\mnku.job	jergs.exe
File opened for modification	C:\Windows\Tasks\vcsl.job	jergs.exe
File created	C:\Windows\Tasks\spfs.job	jergs.exe
File opened for modification	C:\Windows\Tasks\kwjtgxk.job	ddmgw.exe
File created	C:\Windows\Tasks\antlagm.job	jergs.exe
File opened for modification	C:\Windows\Tasks\antlagm.job	jergs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid process

412 NOTEPAD.EXE
1800 NOTEPAD.EXE
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

ddmgw.exe

pid process

1232 ddmgw.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

jergs.exeddmgw.exejergs.exejergs.exejergs.exejergs.exejergs.exe

pid process

1284 jergs.exe
2088 ddmgw.exe
644 jergs.exe
576 jergs.exe
1040 jergs.exe
1752 jergs.exe
3068 jergs.exe

pid	process
412	NOTEPAD.EXE
1800	NOTEPAD.EXE

pid	process
1232	ddmgw.exe

pid	process
1284	jergs.exe
2088	ddmgw.exe
644	jergs.exe
576	jergs.exe
1040	jergs.exe
1752	jergs.exe
3068	jergs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zG.exe

description	pid	process
Token: SeRestorePrivilege	1040	7zG.exe
Token: 35	1040	7zG.exe
Token: SeSecurityPrivilege	1040	7zG.exe
Token: SeSecurityPrivilege	1040	7zG.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zG.exeNOTEPAD.EXE

pid process

1040 7zG.exe
412 NOTEPAD.EXE

pid	process
1040	7zG.exe
412	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

lrthijawd.execmd.exework.exetaskeng.execmd.exelrthijawd.execmd.exework.execmd.exelrthijawd.execmd.exework.exelrthijawd.execmd.exework.exe

description	pid	process	target process
PID 2952 wrote to memory of 1340	2952	lrthijawd.exe	cmd.exe
PID 2952 wrote to memory of 1340	2952	lrthijawd.exe	cmd.exe
PID 2952 wrote to memory of 1340	2952	lrthijawd.exe	cmd.exe
PID 1340 wrote to memory of 2652	1340	cmd.exe	work.exe
PID 1340 wrote to memory of 2652	1340	cmd.exe	work.exe
PID 1340 wrote to memory of 2652	1340	cmd.exe	work.exe
PID 2652 wrote to memory of 1284	2652	work.exe	jergs.exe
PID 2652 wrote to memory of 1284	2652	work.exe	jergs.exe
PID 2652 wrote to memory of 1284	2652	work.exe	jergs.exe
PID 2652 wrote to memory of 1284	2652	work.exe	jergs.exe
PID 2716 wrote to memory of 2452	2716	taskeng.exe	ddmgw.exe
PID 2716 wrote to memory of 2452	2716	taskeng.exe	ddmgw.exe
PID 2716 wrote to memory of 2452	2716	taskeng.exe	ddmgw.exe
PID 2716 wrote to memory of 2452	2716	taskeng.exe	ddmgw.exe
PID 2308 wrote to memory of 1232	2308	cmd.exe	ddmgw.exe
PID 2308 wrote to memory of 1232	2308	cmd.exe	ddmgw.exe
PID 2308 wrote to memory of 1232	2308	cmd.exe	ddmgw.exe
PID 2308 wrote to memory of 1232	2308	cmd.exe	ddmgw.exe
PID 2716 wrote to memory of 584	2716	taskeng.exe	kwjtgxk.exe
PID 2716 wrote to memory of 584	2716	taskeng.exe	kwjtgxk.exe
PID 2716 wrote to memory of 584	2716	taskeng.exe	kwjtgxk.exe
PID 2716 wrote to memory of 584	2716	taskeng.exe	kwjtgxk.exe
PID 2716 wrote to memory of 2516	2716	taskeng.exe	kwjtgxk.exe
PID 2716 wrote to memory of 2516	2716	taskeng.exe	kwjtgxk.exe
PID 2716 wrote to memory of 2516	2716	taskeng.exe	kwjtgxk.exe
PID 2716 wrote to memory of 2516	2716	taskeng.exe	kwjtgxk.exe
PID 2084 wrote to memory of 2748	2084	lrthijawd.exe	cmd.exe
PID 2084 wrote to memory of 2748	2084	lrthijawd.exe	cmd.exe
PID 2084 wrote to memory of 2748	2084	lrthijawd.exe	cmd.exe
PID 2748 wrote to memory of 2184	2748	cmd.exe	work.exe
PID 2748 wrote to memory of 2184	2748	cmd.exe	work.exe
PID 2748 wrote to memory of 2184	2748	cmd.exe	work.exe
PID 2184 wrote to memory of 1872	2184	work.exe	jergs.exe
PID 2184 wrote to memory of 1872	2184	work.exe	jergs.exe
PID 2184 wrote to memory of 1872	2184	work.exe	jergs.exe
PID 2184 wrote to memory of 1872	2184	work.exe	jergs.exe
PID 3036 wrote to memory of 1960	3036	cmd.exe	lrthijawd.exe
PID 3036 wrote to memory of 1960	3036	cmd.exe	lrthijawd.exe
PID 3036 wrote to memory of 1960	3036	cmd.exe	lrthijawd.exe
PID 1960 wrote to memory of 1412	1960	lrthijawd.exe	cmd.exe
PID 1960 wrote to memory of 1412	1960	lrthijawd.exe	cmd.exe
PID 1960 wrote to memory of 1412	1960	lrthijawd.exe	cmd.exe
PID 1412 wrote to memory of 2828	1412	cmd.exe	work.exe
PID 1412 wrote to memory of 2828	1412	cmd.exe	work.exe
PID 1412 wrote to memory of 2828	1412	cmd.exe	work.exe
PID 2828 wrote to memory of 644	2828	work.exe	jergs.exe
PID 2828 wrote to memory of 644	2828	work.exe	jergs.exe
PID 2828 wrote to memory of 644	2828	work.exe	jergs.exe
PID 2828 wrote to memory of 644	2828	work.exe	jergs.exe
PID 2716 wrote to memory of 2704	2716	taskeng.exe	lcot.exe
PID 2716 wrote to memory of 2704	2716	taskeng.exe	lcot.exe
PID 2716 wrote to memory of 2704	2716	taskeng.exe	lcot.exe
PID 2716 wrote to memory of 2704	2716	taskeng.exe	lcot.exe
PID 3036 wrote to memory of 2456	3036	cmd.exe	lrthijawd.exe
PID 3036 wrote to memory of 2456	3036	cmd.exe	lrthijawd.exe
PID 3036 wrote to memory of 2456	3036	cmd.exe	lrthijawd.exe
PID 2456 wrote to memory of 1232	2456	lrthijawd.exe	cmd.exe
PID 2456 wrote to memory of 1232	2456	lrthijawd.exe	cmd.exe
PID 2456 wrote to memory of 1232	2456	lrthijawd.exe	cmd.exe
PID 1232 wrote to memory of 1916	1232	cmd.exe	work.exe
PID 1232 wrote to memory of 1916	1232	cmd.exe	work.exe
PID 1232 wrote to memory of 1916	1232	cmd.exe	work.exe
PID 1916 wrote to memory of 576	1916	work.exe	jergs.exe
PID 1916 wrote to memory of 576	1916	work.exe	jergs.exe

C:\Users\Admin\AppData\Local\Temp\lrthijawd.exe
"C:\Users\Admin\AppData\Local\Temp\lrthijawd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    work.exe -priverdD
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\jergs.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\jergs.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      PID:1284

C:\Windows\system32\taskeng.exe
taskeng.exe {C3ACD599-6A4D-40AE-88CB-FF6326F1AEE3} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\ProgramData\vxadefg\ddmgw.exe
  C:\ProgramData\vxadefg\ddmgw.exe start2
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\ProgramData\kprub\kwjtgxk.exe
  C:\ProgramData\kprub\kwjtgxk.exe start2
  2⤵
  - Executes dropped EXE
  PID:584
- C:\ProgramData\kprub\kwjtgxk.exe
  C:\ProgramData\kprub\kwjtgxk.exe start2
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\ProgramData\aiaqa\lcot.exe
  C:\ProgramData\aiaqa\lcot.exe start2
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\ProgramData\jxuoke\mnku.exe
  C:\ProgramData\jxuoke\mnku.exe start2
  2⤵
  - Executes dropped EXE
  PID:856
- C:\ProgramData\idwur\antlagm.exe
  C:\ProgramData\idwur\antlagm.exe start2
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\ProgramData\hqtw\vcsl.exe
  C:\ProgramData\hqtw\vcsl.exe start2
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\ProgramData\cocuoc\spfs.exe
  C:\ProgramData\cocuoc\spfs.exe start2
  2⤵
  - Executes dropped EXE
  PID:780

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\ProgramData\vxadefg\ddmgw.exe
  ddmgw.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1232

C:\ProgramData\vxadefg\ddmgw.exe
"C:\ProgramData\vxadefg\ddmgw.exe"
1⤵
- Executes dropped EXE
PID:2928

C:\ProgramData\vxadefg\ddmgw.exe
"C:\ProgramData\vxadefg\ddmgw.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2088

C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe"
1⤵
- Executes dropped EXE
PID:1632

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\RarSFX0\work\" -spe -an -ai#7zMap13359:104:7zEvent5515
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1040

C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe"
1⤵
- Executes dropped EXE
PID:712

C:\Users\Admin\AppData\Local\Temp\lrthijawd.exe
"C:\Users\Admin\AppData\Local\Temp\lrthijawd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\1.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\work.exe
    work.exe -priverdD
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\jergs.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\jergs.exe"
      4⤵
      Executes dropped EXE
      PID:1872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\lrthijawd.exe
  lrthijawd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX3\1.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX3\work.exe
      work.exe -priverdD
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX4\jergs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX4\jergs.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:644
- C:\Users\Admin\AppData\Local\Temp\lrthijawd.exe
  lrthijawd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX2\1.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\work.exe
      work.exe -priverdD
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX5\jergs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX5\jergs.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:576
- C:\Users\Admin\AppData\Local\Temp\lrthijawd.exe
  lrthijawd.exe
  2⤵
  PID:2232
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX4\1.bat" "
    3⤵
    - Loads dropped DLL
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX4\work.exe
      work.exe -priverdD
      4⤵
      Executes dropped EXE
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX6\jergs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX6\jergs.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1040
- C:\Users\Admin\AppData\Local\Temp\lrthijawd.exe
  lrthijawd.exe
  2⤵
  PID:2832
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX5\1.bat" "
    3⤵
    - Loads dropped DLL
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX5\work.exe
      work.exe -priverdD
      4⤵
      Executes dropped EXE
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX7\jergs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX7\jergs.exe"
        5⤵
        Executes dropped EXE
        
        PID:1684
- C:\Users\Admin\AppData\Local\Temp\lrthijawd.exe
  lrthijawd.exe
  2⤵
  PID:1468
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX6\1.bat" "
    3⤵
    - Loads dropped DLL
    PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX6\work.exe
      work.exe -priverdD
      4⤵
      Executes dropped EXE
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX8\jergs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX8\jergs.exe"
        5⤵
        Executes dropped EXE
        
        PID:2604
- C:\Users\Admin\AppData\Local\Temp\lrthijawd.exe
  lrthijawd.exe
  2⤵
  PID:2236
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX7\1.bat" "
    3⤵
    - Loads dropped DLL
    PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX7\work.exe
      work.exe -priverdD
      4⤵
      Executes dropped EXE
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX9\jergs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX9\jergs.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1752

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20240215_065848_449.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:412

C:\Users\Admin\AppData\Local\Temp\RarSFX6\jergs.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX6\jergs.exe"
1⤵
- Executes dropped EXE
PID:1976

C:\Users\Admin\AppData\Local\Temp\RarSFX6\jergs.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX6\jergs.exe"
1⤵
- Executes dropped EXE
PID:764

C:\Users\Admin\AppData\Local\Temp\RarSFX6\jergs.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX6\jergs.exe"
1⤵
- Executes dropped EXE
PID:2528

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX7\1.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:1800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Loads dropped DLL
PID:1672
- C:\Users\Admin\AppData\Local\Temp\RarSFX7\work.exe
  work.exe -priverdD
  2⤵
  - Executes dropped EXE
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\RarSFX5\jergs.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX5\jergs.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3068
- C:\Users\Admin\AppData\Local\Temp\RarSFX7\work.exe
  work.exe -priverdD
  2⤵
  - Executes dropped EXE
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\RarSFX6\jergs.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX6\jergs.exe"
    3⤵
    - Executes dropped EXE
    PID:2472
- C:\Users\Admin\AppData\Local\Temp\RarSFX7\work.exe
  work.exe -priverdD
  2⤵
  - Executes dropped EXE
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\RarSFX5\jergs.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX5\jergs.exe"
    3⤵
    - Executes dropped EXE
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

Filesize
35B

MD5
ff59d999beb970447667695ce3273f75

SHA1
316fa09f467ba90ac34a054daf2e92e6e2854ff8

SHA256
065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2

SHA512
d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\jergs.exe

Filesize
16KB

MD5
c661a77c31f83c413a96b5537ad31989

SHA1
8a5a47e39a9efa9dc4de447d2ae4cd5e375e3557

SHA256
cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1

SHA512
b86e45d36d8566b51f932f660ee9c3d79cea1a2eb34a9f7da7b2ccc5e50c74f319e8005e43d719c5722ec148ddddf1351a7f9edc430888e572b3884d1610b1aa

Download Submit
C:\Windows\Tasks\ddmgw.job

Filesize
234B

MD5
1cbdb162c6428bff02dec5ae7e13b21a

SHA1
e907870e3a6a73fad7a6a1fa175f578fbdadead3

SHA256
468da111678db9a405886fedeef3951e8c06c581a25bb29cc1fe5e719cc929f3

SHA512
d319e76db5fd70e178047b129c530de41dc5cddd3329928c968a399c2adffae5a7ecc74015e6defa940f0ed673002bb37ecbf6f10b480948d5978d9c015595f5

Download Submit
C:\Windows\Tasks\kwjtgxk.job

Filesize
234B

MD5
48e640904e73c43dec0901c6acae8658

SHA1
b5322cc3df3e180019ae1a99c4d544c6db9e2abe

SHA256
d778a4dd22cc80220d6b171542b7959370d4527258115447e1eed54c35d61f9f

SHA512
124fcad5c0c28d1e3fd383115376b3c95fafbc8a1f3fe5beefbd88f441972f66454cdf66bfc80b49342a8110d9e1257093107e4ab7472c440a860eca7629b760

Download Submit
C:\Windows\Tasks\lcot.job

Filesize
228B

MD5
d9c919aa0d482e649a414fdcec350ec1

SHA1
8892565928fe8ce3088035d4c4cd1c12819e91a5

SHA256
0427c3278ba527da2b76703df5edebb0a3fc4ba4de95d91d5d80227ae899deb6

SHA512
93125497655e53a474237e37df48b526cba5916daa318ed89914c608a7b1835185500a67e6acb6ec9462574fc290770fd273428d75d80771c160789565759916

Download Submit
C:\Windows\Tasks\mnku.job

Filesize
230B

MD5
2cbf90ba64ba86c59e0c3934bd9aad4b

SHA1
72d6895424386468e618ead7b9175c6002adcbf7

SHA256
2e6c93b4ecdf4369959c8881f0d0b67b0e1284fdc3cf4e5f38884555f55bcc3d

SHA512
caab6ee107e52cd9f54ed5494e40a275725ce83b068d3ee2f88da05c4ea36a026df8d0cadfd3b032c21f13c3f66bb26ceabe167d2ce0c22060d4073af1713562

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

Filesize
453KB

MD5
405b7fbe8c0ed98620064f0cd80f24c4

SHA1
bb9e45038e8a9f7b7cd0db62858ac65c74b74821

SHA256
9dd8267e66dc584eecb3bece47e826d3189e41077f4083acdfc9a4f623b9c187

SHA512
3dd4c407f6c2250d20c005e816e80ad442bb07f84ab02e25951331808fb4229219f9fddbcf1ac2e6d70985e3077a6401905f18a8b2c633e9d0a8b9cc6971b61d

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads