Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25-07-2024 14:28

General

  • Target

    055bb90b6b1355dfbd03fc77826720e14b37934a078fa1caa1ef0e47e04a99e8.exe

  • Size

    246KB

  • MD5

    97a3d3bbbf620a1eead18626beef0932

  • SHA1

    52a1b750a8bb5b64e153179e090f95c69bd340b8

  • SHA256

    055bb90b6b1355dfbd03fc77826720e14b37934a078fa1caa1ef0e47e04a99e8

  • SHA512

    cf5b5a215c7e2ac16306a3f3737d9c7a57c87e8cbe92299e947cf734a8379a23f18b8a43058d359b10e1aa7597f141e54862d6980186d1614902b803c233385d

  • SSDEEP

    3072:1+m9ZYH0gOSr9fM9pXF57/VQ9LZjfnGCH:sSSOj99/GLpe

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\055bb90b6b1355dfbd03fc77826720e14b37934a078fa1caa1ef0e47e04a99e8.exe
    "C:\Users\Admin\AppData\Local\Temp\055bb90b6b1355dfbd03fc77826720e14b37934a078fa1caa1ef0e47e04a99e8.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\FYGAKz.exe
      C:\Users\Admin\AppData\Local\Temp\FYGAKz.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\05af77cc.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2712
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {BCB4C794-A76F-4F30-B973-DD0E6084E2AB} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\ProgramData\qrrrrr\xakirj.exe
      C:\ProgramData\qrrrrr\xakirj.exe start
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Windows\TEMP\FYGAKz.exe
        C:\Windows\TEMP\FYGAKz.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Windows\TEMP\33c16c8c.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\qrrrrr\xakirj.exe

    Filesize

    246KB

    MD5

    97a3d3bbbf620a1eead18626beef0932

    SHA1

    52a1b750a8bb5b64e153179e090f95c69bd340b8

    SHA256

    055bb90b6b1355dfbd03fc77826720e14b37934a078fa1caa1ef0e47e04a99e8

    SHA512

    cf5b5a215c7e2ac16306a3f3737d9c7a57c87e8cbe92299e947cf734a8379a23f18b8a43058d359b10e1aa7597f141e54862d6980186d1614902b803c233385d

  • C:\Users\Admin\AppData\Local\Temp\05af77cc.bat

    Filesize

    187B

    MD5

    6560607db7d3586eeaff002136dfabb1

    SHA1

    42997c3e80f120067109e3400f3fabd21145cd4b

    SHA256

    35122a95bfe9c0d84ea1842507b47fa9ddd0595c1c63de406a28d24e3e118a13

    SHA512

    82608492ab324fee46a36a6b4b1286db37fd0cf28aa70108164792aabbc45874cb20e4680c781e8c5f770baab116176091afd86af65a631008bdaa97ebe12f15

  • C:\Users\Admin\AppData\Local\Temp\75117FB9.exe

    Filesize

    4B

    MD5

    20879c987e2f9a916e578386d499f629

    SHA1

    c7b33ddcc42361fdb847036fc07e880b81935d5d

    SHA256

    9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

    SHA512

    bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

  • C:\Users\Admin\AppData\Local\Temp\FYGAKz.exe

    Filesize

    15KB

    MD5

    f7d21de5c4e81341eccd280c11ddcc9a

    SHA1

    d4e9ef10d7685d491583c6fa93ae5d9105d815bd

    SHA256

    4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794

    SHA512

    e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

  • C:\Windows\TEMP\33c16c8c.bat

    Filesize

    133B

    MD5

    804b10e866f0f57dab2d7f90ec3ab7f1

    SHA1

    6136cfec63e8d643407b631044387168f79d8712

    SHA256

    fa0ba342566ae8f896c021ff8650a8314e973fa6248781fbefa09ed3b96f9435

    SHA512

    5d9834e640a75663e328df7ae8eabcc570e7d66e441539ea5eabf4a5769567c5a463be0e355c22f9f870972fe44641002d7975193df34f222e77acaf585b37bb

  • memory/1060-85-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/1060-64-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

  • memory/1060-68-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

  • memory/1960-16-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/1960-9-0x0000000000F70000-0x0000000000F79000-memory.dmp

    Filesize

    36KB

  • memory/1960-54-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/1960-10-0x0000000000F70000-0x0000000000F79000-memory.dmp

    Filesize

    36KB

  • memory/1960-1-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/1960-18-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1960-17-0x00000000001C0000-0x00000000001C9000-memory.dmp

    Filesize

    36KB

  • memory/1960-83-0x00000000002B0000-0x00000000003B0000-memory.dmp

    Filesize

    1024KB

  • memory/2000-71-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

  • memory/2416-52-0x0000000000F70000-0x0000000000F79000-memory.dmp

    Filesize

    36KB

  • memory/2416-11-0x0000000000F70000-0x0000000000F79000-memory.dmp

    Filesize

    36KB