Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
05-06-2024 02:13
General
-
Target
cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe
-
Size
16KB
-
MD5
c661a77c31f83c413a96b5537ad31989
-
SHA1
8a5a47e39a9efa9dc4de447d2ae4cd5e375e3557
-
SHA256
cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1
-
SHA512
b86e45d36d8566b51f932f660ee9c3d79cea1a2eb34a9f7da7b2ccc5e50c74f319e8005e43d719c5722ec148ddddf1351a7f9edc430888e572b3884d1610b1aa
-
SSDEEP
384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V
Malware Config
Extracted
systembc
clwtumberaero.cyou:4001
185.43.220.45:4001
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Executes dropped EXE 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe"C:\Users\Admin\AppData\Local\Temp\cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\jxndsiw\dtrk.exeC:\ProgramData\jxndsiw\dtrk.exe start21⤵
- Executes dropped EXE
-
C:\ProgramData\jxndsiw\dtrk.exeC:\ProgramData\jxndsiw\dtrk.exe start21⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5c661a77c31f83c413a96b5537ad31989
SHA18a5a47e39a9efa9dc4de447d2ae4cd5e375e3557
SHA256cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1
SHA512b86e45d36d8566b51f932f660ee9c3d79cea1a2eb34a9f7da7b2ccc5e50c74f319e8005e43d719c5722ec148ddddf1351a7f9edc430888e572b3884d1610b1aa