systembc | 5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca

General

Target

5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe
Size

507KB
MD5

d8f3abf2c283de95b8f1b8474220adfd
SHA1

3ca1423519539f0c608e2cc6f35e7a5a5977edb4
SHA256

5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca
SHA512

e6c8883caf517ab98773b3b5be78d2aa3a1bd01c55576cb4fbcc75ba3a39cd09f60482307a3ebc83fd91a5f5aca7731b188b932979df5f495351d70346fd2557

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

mainscpnl.xyz:4207

backpscpnl.xyz:4207

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in System32 directory 2 IoCs

Processes:

5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Obsidium\{49E7EF38-814504E7-31140760-52C4F6AE}.1443228313920530249	5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\.obs32\{49E7EF38-814504E7-31140760-52C4F6AE}.1443228313920530249	5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe

Drops file in Windows directory 2 IoCs

Processes:

5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe
File opened for modification	C:\Windows\Tasks\wow64.job	5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotification.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

MusNotification.exe

description pid process

Token: SeShutdownPrivilege 3516 MusNotification.exe
Token: SeCreatePagefilePrivilege 3516 MusNotification.exe

description	pid	process
Token: SeShutdownPrivilege	3516	MusNotification.exe
Token: SeCreatePagefilePrivilege	3516	MusNotification.exe

C:\Users\Admin\AppData\Local\Temp\5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe
"C:\Users\Admin\AppData\Local\Temp\5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe"
1⤵
- Drops file in Windows directory
PID:3180

C:\Users\Admin\AppData\Local\Temp\5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe
C:\Users\Admin\AppData\Local\Temp\5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca.exe start
1⤵
- Drops file in System32 directory
PID:2464

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-139-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2464-140-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2464-141-0x00000000010C0000-0x00000000010C7000-memory.dmp

Filesize
28KB

Download
memory/2464-146-0x0000000001110000-0x000000000114B000-memory.dmp

Filesize
236KB

Download
memory/2464-147-0x0000000001150000-0x0000000001151000-memory.dmp

Filesize
4KB

Download
memory/3180-130-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/3180-131-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/3180-134-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/3180-133-0x0000000002640000-0x0000000002647000-memory.dmp

Filesize
28KB

Download
memory/3180-132-0x0000000002690000-0x00000000026CB000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads