systembc | fdd7069cdc8a066739331213b2076f2ca6acd0e97070f5d1e4dbd9d1b756a35b

General

Target

09a5565e828aa3da2f70b21cbc21b08b.exe
Size

372KB
MD5

09a5565e828aa3da2f70b21cbc21b08b
SHA1

fbdb5431f6373262c69715c1ce3b4eb691c16714
SHA256

fdd7069cdc8a066739331213b2076f2ca6acd0e97070f5d1e4dbd9d1b756a35b
SHA512

236897b15b20214eeb42e10a171a77cede6a7c29cc1295255c4f69c3fe53d2623fa4ebc3ae142d1fb2a28f0527d7245ecd7822f9b9a8450de1af875eacbd8a64

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

135.125.248.50:443

146.70.53.169:443

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

6988120409.exe1728765063.exe1728765063.exe

pid process

3252 6988120409.exe
2208 1728765063.exe
3792 1728765063.exe

pid	process
3252	6988120409.exe
2208	1728765063.exe
3792	1728765063.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

09a5565e828aa3da2f70b21cbc21b08b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	09a5565e828aa3da2f70b21cbc21b08b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Drops file in Windows directory 2 IoCs

Processes:

1728765063.exe

description ioc process

File created C:\Windows\Tasks\wow64.job 1728765063.exe
File opened for modification C:\Windows\Tasks\wow64.job 1728765063.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1300 2348 WerFault.exe 09a5565e828aa3da2f70b21cbc21b08b.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4236 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 4236 taskkill.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	1728765063.exe
File opened for modification	C:\Windows\Tasks\wow64.job	1728765063.exe

pid	pid_target	process	target process
1300	2348	WerFault.exe	09a5565e828aa3da2f70b21cbc21b08b.exe

pid	process
4236	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	4236	taskkill.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

09a5565e828aa3da2f70b21cbc21b08b.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2348 wrote to memory of 2992	2348	09a5565e828aa3da2f70b21cbc21b08b.exe	cmd.exe
PID 2348 wrote to memory of 2992	2348	09a5565e828aa3da2f70b21cbc21b08b.exe	cmd.exe
PID 2348 wrote to memory of 2992	2348	09a5565e828aa3da2f70b21cbc21b08b.exe	cmd.exe
PID 2992 wrote to memory of 3252	2992	cmd.exe	6988120409.exe
PID 2992 wrote to memory of 3252	2992	cmd.exe	6988120409.exe
PID 2992 wrote to memory of 3252	2992	cmd.exe	6988120409.exe
PID 2348 wrote to memory of 4248	2348	09a5565e828aa3da2f70b21cbc21b08b.exe	cmd.exe
PID 2348 wrote to memory of 4248	2348	09a5565e828aa3da2f70b21cbc21b08b.exe	cmd.exe
PID 2348 wrote to memory of 4248	2348	09a5565e828aa3da2f70b21cbc21b08b.exe	cmd.exe
PID 4248 wrote to memory of 2208	4248	cmd.exe	1728765063.exe
PID 4248 wrote to memory of 2208	4248	cmd.exe	1728765063.exe
PID 4248 wrote to memory of 2208	4248	cmd.exe	1728765063.exe
PID 2348 wrote to memory of 5076	2348	09a5565e828aa3da2f70b21cbc21b08b.exe	cmd.exe
PID 2348 wrote to memory of 5076	2348	09a5565e828aa3da2f70b21cbc21b08b.exe	cmd.exe
PID 2348 wrote to memory of 5076	2348	09a5565e828aa3da2f70b21cbc21b08b.exe	cmd.exe
PID 5076 wrote to memory of 4236	5076	cmd.exe	taskkill.exe
PID 5076 wrote to memory of 4236	5076	cmd.exe	taskkill.exe
PID 5076 wrote to memory of 4236	5076	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\09a5565e828aa3da2f70b21cbc21b08b.exe
"C:\Users\Admin\AppData\Local\Temp\09a5565e828aa3da2f70b21cbc21b08b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\6988120409.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Users\Admin\AppData\Local\Temp\6988120409.exe
"C:\Users\Admin\AppData\Local\Temp\6988120409.exe"
3⤵
- Executes dropped EXE
PID:3252

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1728765063.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4248

C:\Users\Admin\AppData\Local\Temp\1728765063.exe
"C:\Users\Admin\AppData\Local\Temp\1728765063.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "09a5565e828aa3da2f70b21cbc21b08b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\09a5565e828aa3da2f70b21cbc21b08b.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "09a5565e828aa3da2f70b21cbc21b08b.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 1460
2⤵
- Program crash
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2348 -ip 2348
1⤵
PID:4240

C:\Users\Admin\AppData\Local\Temp\1728765063.exe
C:\Users\Admin\AppData\Local\Temp\1728765063.exe start
1⤵
- Executes dropped EXE
PID:3792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1728765063.exe
Filesize
946KB

MD5
c65326b66f8e1799d3b4b62ced8431ad

SHA1
2435632e756173e92a1f14e10573bdc32895a6c5

SHA256
c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

SHA512
034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1728765063.exe
Filesize
946KB

MD5
c65326b66f8e1799d3b4b62ced8431ad

SHA1
2435632e756173e92a1f14e10573bdc32895a6c5

SHA256
c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

SHA512
034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1728765063.exe
Filesize
946KB

MD5
c65326b66f8e1799d3b4b62ced8431ad

SHA1
2435632e756173e92a1f14e10573bdc32895a6c5

SHA256
c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

SHA512
034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\6988120409.exe
Filesize
84KB

MD5
bd36b140501a2597a130c5d1a6105626

SHA1
ccb488217d9d32334fff09b0fb3d857e3ab4da6b

SHA256
1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

SHA512
882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

Download Submit
C:\Users\Admin\AppData\Local\Temp\6988120409.exe
Filesize
84KB

MD5
bd36b140501a2597a130c5d1a6105626

SHA1
ccb488217d9d32334fff09b0fb3d857e3ab4da6b

SHA256
1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

SHA512
882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

Download Submit
memory/2208-138-0x0000000000000000-mapping.dmp

Download
memory/2208-143-0x00000000007F0000-0x00000000007F5000-memory.dmp

Filesize
20KB

Download
memory/2208-144-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/2348-130-0x0000000002CEE000-0x0000000002D09000-memory.dmp

Filesize
108KB

Download
memory/2348-132-0x0000000000400000-0x0000000002B7B000-memory.dmp

Filesize
39.5MB

Download
memory/2348-131-0x0000000002C70000-0x0000000002C9A000-memory.dmp

Filesize
168KB

Download
memory/2992-133-0x0000000000000000-mapping.dmp

Download
memory/3252-134-0x0000000000000000-mapping.dmp

Download
memory/3792-146-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/4236-142-0x0000000000000000-mapping.dmp

Download
memory/4248-137-0x0000000000000000-mapping.dmp

Download
memory/5076-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing