Overview

overview

10

Static

static

3

odd DLL/au...te.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    291s
  • max time network
    275s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 16:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    odd DLL/autoupdate.dll

  • Size

    3.0MB

  • MD5

    729527a4e620ce6650b35858f43f4f44

  • SHA1

    d01df5fd3edad753fdbbd3a15406f7b9e28e910e

  • SHA256

    b57795017364deb0f319fa62c440500882562f6650e651b49058e080cbe8f9a8

  • SHA512

    c81ba619a3a74d2fa893b980ac11d2a49d8be2c42617f2cf0a65c04f26e1ae2a088bc2ce40d7c7171adace6e5d92d8eccac04fb6fafea6d9224fe79e1a70a108

  • SSDEEP

    49152:ciz0lsT/VMGu3M1AOhVZ1zY0tRJujI340tIsN69EdjXMPr4EClomXSK754zuBLZs:cqzuxk22fvXMTkoP9

Score
10/10
systembctrojan

Malware Config

Extracted

Family

systembc

C2

66.85.173.12:443

23.131.216.131:443

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • Blocklisted process makes network request 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\odd DLL\autoupdate.dll",#1
    1⤵
    • Blocklisted process makes network request
    PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1136-0-0x00007FF8E7410000-0x00007FF8E771B000-memory.dmp

    Filesize

    3.0MB

    Download

  • memory/1136-1-0x00007FF8E7410000-0x00007FF8E75AB000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/1136-2-0x00007FF8E7410000-0x00007FF8E771B000-memory.dmp

    Filesize

    3.0MB

    Download