Analysis
- max time kernel
120s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
18/01/2025, 17:08
General
- Target random.exe
- Size 1.2MB
- Sample250118-vnpx4symbs
- SHA256 30fee1328110552c83645241f3ebbfb3e743182c9c08d5259cec20941c5c0f4a
Malware Config
Extracted
-
systembc
-
wodresomdaymomentum.org
-
dns
5.132.191.104
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Systembc family
- Drops startup file 1 IoCs
- Executes dropped EXE 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\random.exe"C:\Users\Admin\AppData\Local\Temp\random.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\random.exe"C:\Users\Admin\AppData\Local\Temp\random.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\hensrm\dwsufrg.exe"C:\ProgramData\hensrm\dwsufrg.exe"2⤵
- Executes dropped EXE
-
-
C:\ProgramData\hensrm\dwsufrg.exe"C:\ProgramData\hensrm\dwsufrg.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\hensrm\dwsufrg.exeC:\ProgramData\hensrm\dwsufrg.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\hensrm\dwsufrg.exeC:\ProgramData\hensrm\dwsufrg.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
dwsufrg.exe
Test Task17.job
memory/2584-0-0x0000000074F1E000-0x0000000074F1F000-memory.dmp
memory/2584-1-0x0000000000740000-0x0000000000878000-memory.dmp
memory/2584-2-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/2584-3-0x0000000005170000-0x000000000526E000-memory.dmp
memory/2584-4-0x0000000005320000-0x000000000541E000-memory.dmp
memory/2584-5-0x00000000059E0000-0x0000000005F84000-memory.dmp
memory/2584-6-0x0000000005530000-0x00000000055C2000-memory.dmp
memory/2584-20-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-28-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-62-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-70-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-68-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-66-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-64-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-60-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-58-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-56-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-54-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-52-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-50-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-46-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-44-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-42-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-40-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-38-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-36-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-34-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-32-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-30-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-26-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-24-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-23-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-18-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-16-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-14-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-12-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-10-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-8-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-48-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-7-0x0000000005320000-0x0000000005419000-memory.dmp
memory/2584-1329-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/2584-1330-0x0000000005620000-0x0000000005678000-memory.dmp
memory/2584-1331-0x00000000057F0000-0x0000000005846000-memory.dmp
memory/2584-1332-0x0000000005850000-0x000000000589C000-memory.dmp
memory/2584-1333-0x0000000074F1E000-0x0000000074F1F000-memory.dmp
memory/2584-1334-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/2584-1335-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/2584-1336-0x00000000056C0000-0x0000000005714000-memory.dmp
memory/2584-1342-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/2584-1351-0x0000000002E78000-0x0000000002E79000-memory.dmp
memory/2584-1350-0x0000000002E2B000-0x0000000002E2C000-memory.dmp
memory/2584-1348-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/2584-1354-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/3268-1349-0x0000000000400000-0x0000000000407000-memory.dmp
memory/4868-1357-0x0000000074F1E000-0x0000000074F1F000-memory.dmp
memory/4868-1358-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/4868-2681-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/4868-2682-0x0000000074F1E000-0x0000000074F1F000-memory.dmp
memory/4868-2683-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/4868-2684-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/4868-2689-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/4868-2695-0x0000000074F10000-0x00000000756C0000-memory.dmp
memory/4868-2696-0x0000000074F10000-0x00000000756C0000-memory.dmp