Analysis
- max time kernel
133s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/01/2025, 04:34
General
- Target 9b1fb523aeaca79304a5433fdc73c03990472b5d7c1c91d083bc02ab1da1c19b.exe
- Size 1.2MB
- Sample250120-e6931a1rcj
- SHA256 9b1fb523aeaca79304a5433fdc73c03990472b5d7c1c91d083bc02ab1da1c19b
Malware Config
Extracted
-
systembc
-
wodresomdaymomentum.org
-
dns
5.132.191.104
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Systembc family
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9b1fb523aeaca79304a5433fdc73c03990472b5d7c1c91d083bc02ab1da1c19b.exe"C:\Users\Admin\AppData\Local\Temp\9b1fb523aeaca79304a5433fdc73c03990472b5d7c1c91d083bc02ab1da1c19b.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\9b1fb523aeaca79304a5433fdc73c03990472b5d7c1c91d083bc02ab1da1c19b.exe"C:\Users\Admin\AppData\Local\Temp\9b1fb523aeaca79304a5433fdc73c03990472b5d7c1c91d083bc02ab1da1c19b.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\xbeibu\rukest.exe"C:\ProgramData\xbeibu\rukest.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\xbeibu\rukest.exeC:\ProgramData\xbeibu\rukest.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
rukest.exe
Test Task17.job
memory/1656-2686-0x00000000052D0000-0x0000000005324000-memory.dmp
memory/1656-2685-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1656-2700-0x00000000026E1000-0x00000000026E2000-memory.dmp
memory/1656-2698-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1656-2701-0x000000000271F000-0x0000000002720000-memory.dmp
memory/1656-2691-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1656-2703-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1656-1358-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1656-2684-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1656-2683-0x000000007447E000-0x000000007447F000-memory.dmp
memory/1656-2682-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/1656-1357-0x000000007447E000-0x000000007447F000-memory.dmp
memory/2408-1349-0x0000000000400000-0x0000000000407000-memory.dmp
memory/3140-2699-0x0000000000400000-0x0000000000407000-memory.dmp
memory/3456-14-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-1332-0x0000000005040000-0x000000000508C000-memory.dmp
memory/3456-52-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-48-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-46-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-44-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-42-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-40-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-38-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-36-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-34-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-30-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-28-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-26-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-24-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-20-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-18-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-16-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-0-0x0000000074B0E000-0x0000000074B0F000-memory.dmp
memory/3456-10-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-8-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-7-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-50-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-32-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-1329-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/3456-1330-0x0000000004E20000-0x0000000004E78000-memory.dmp
memory/3456-1331-0x0000000004FE0000-0x0000000005036000-memory.dmp
memory/3456-54-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-1333-0x0000000074B0E000-0x0000000074B0F000-memory.dmp
memory/3456-1334-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/3456-1335-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/3456-1336-0x00000000057D0000-0x0000000005824000-memory.dmp
memory/3456-1342-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/3456-1351-0x000000000267B000-0x000000000267C000-memory.dmp
memory/3456-1350-0x0000000002629000-0x000000000262A000-memory.dmp
memory/3456-58-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-1352-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/3456-1348-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/3456-60-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-62-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-64-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-66-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-68-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-70-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-56-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-22-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-12-0x0000000004B70000-0x0000000004C6A000-memory.dmp
memory/3456-6-0x0000000004D20000-0x0000000004DB2000-memory.dmp
memory/3456-5-0x0000000005220000-0x00000000057C4000-memory.dmp
memory/3456-4-0x0000000004B70000-0x0000000004C70000-memory.dmp
memory/3456-3-0x0000000004970000-0x0000000004A6E000-memory.dmp
memory/3456-2-0x0000000074B00000-0x00000000752B0000-memory.dmp
memory/3456-1-0x0000000000070000-0x00000000001A8000-memory.dmp