systembc | d94e02cfb25da71355a6d85538a24374c050962c4e027eaae2e230fe52514e2a

General

Target

bb8dba7e21b5f0720407e0acdde6a34e.exe
Size

373KB
MD5

bb8dba7e21b5f0720407e0acdde6a34e
SHA1

27e708c7940708ec158245bfb7f9f671f6664b13
SHA256

d94e02cfb25da71355a6d85538a24374c050962c4e027eaae2e230fe52514e2a
SHA512

b83aedd35920a402033d9381d67d5ade247afe55c8c5d7fc0eb5ee79d0c5cd69bd3e2538881e7d8d2bdcf04b65219f802d038b1757a395709e20b52462d12266

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

135.125.248.50:443

146.70.53.169:443

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

5732955896.exe2647864961.exe2647864961.exe

pid process

2336 5732955896.exe
4156 2647864961.exe
4696 2647864961.exe

pid	process
2336	5732955896.exe
4156	2647864961.exe
4696	2647864961.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bb8dba7e21b5f0720407e0acdde6a34e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	bb8dba7e21b5f0720407e0acdde6a34e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Drops file in Windows directory 2 IoCs

Processes:

2647864961.exe

description ioc process

File created C:\Windows\Tasks\wow64.job 2647864961.exe
File opened for modification C:\Windows\Tasks\wow64.job 2647864961.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1028 1596 WerFault.exe bb8dba7e21b5f0720407e0acdde6a34e.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4788 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 4788 taskkill.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	2647864961.exe
File opened for modification	C:\Windows\Tasks\wow64.job	2647864961.exe

pid	pid_target	process	target process
1028	1596	WerFault.exe	bb8dba7e21b5f0720407e0acdde6a34e.exe

pid	process
4788	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	4788	taskkill.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

bb8dba7e21b5f0720407e0acdde6a34e.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1596 wrote to memory of 1760	1596	bb8dba7e21b5f0720407e0acdde6a34e.exe	cmd.exe
PID 1596 wrote to memory of 1760	1596	bb8dba7e21b5f0720407e0acdde6a34e.exe	cmd.exe
PID 1596 wrote to memory of 1760	1596	bb8dba7e21b5f0720407e0acdde6a34e.exe	cmd.exe
PID 1760 wrote to memory of 2336	1760	cmd.exe	5732955896.exe
PID 1760 wrote to memory of 2336	1760	cmd.exe	5732955896.exe
PID 1760 wrote to memory of 2336	1760	cmd.exe	5732955896.exe
PID 1596 wrote to memory of 3744	1596	bb8dba7e21b5f0720407e0acdde6a34e.exe	cmd.exe
PID 1596 wrote to memory of 3744	1596	bb8dba7e21b5f0720407e0acdde6a34e.exe	cmd.exe
PID 1596 wrote to memory of 3744	1596	bb8dba7e21b5f0720407e0acdde6a34e.exe	cmd.exe
PID 3744 wrote to memory of 4156	3744	cmd.exe	2647864961.exe
PID 3744 wrote to memory of 4156	3744	cmd.exe	2647864961.exe
PID 3744 wrote to memory of 4156	3744	cmd.exe	2647864961.exe
PID 1596 wrote to memory of 3832	1596	bb8dba7e21b5f0720407e0acdde6a34e.exe	cmd.exe
PID 1596 wrote to memory of 3832	1596	bb8dba7e21b5f0720407e0acdde6a34e.exe	cmd.exe
PID 1596 wrote to memory of 3832	1596	bb8dba7e21b5f0720407e0acdde6a34e.exe	cmd.exe
PID 3832 wrote to memory of 4788	3832	cmd.exe	taskkill.exe
PID 3832 wrote to memory of 4788	3832	cmd.exe	taskkill.exe
PID 3832 wrote to memory of 4788	3832	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\bb8dba7e21b5f0720407e0acdde6a34e.exe
"C:\Users\Admin\AppData\Local\Temp\bb8dba7e21b5f0720407e0acdde6a34e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\5732955896.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\5732955896.exe
"C:\Users\Admin\AppData\Local\Temp\5732955896.exe"
3⤵
- Executes dropped EXE
PID:2336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\2647864961.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3744

C:\Users\Admin\AppData\Local\Temp\2647864961.exe
"C:\Users\Admin\AppData\Local\Temp\2647864961.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4156

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "bb8dba7e21b5f0720407e0acdde6a34e.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bb8dba7e21b5f0720407e0acdde6a34e.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3832

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "bb8dba7e21b5f0720407e0acdde6a34e.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 1460
2⤵
- Program crash
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1596 -ip 1596
1⤵
PID:4896

C:\Users\Admin\AppData\Local\Temp\2647864961.exe
C:\Users\Admin\AppData\Local\Temp\2647864961.exe start
1⤵
- Executes dropped EXE
PID:4696

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2647864961.exe
Filesize
946KB

MD5
c65326b66f8e1799d3b4b62ced8431ad

SHA1
2435632e756173e92a1f14e10573bdc32895a6c5

SHA256
c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

SHA512
034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2647864961.exe
Filesize
946KB

MD5
c65326b66f8e1799d3b4b62ced8431ad

SHA1
2435632e756173e92a1f14e10573bdc32895a6c5

SHA256
c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

SHA512
034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2647864961.exe
Filesize
946KB

MD5
c65326b66f8e1799d3b4b62ced8431ad

SHA1
2435632e756173e92a1f14e10573bdc32895a6c5

SHA256
c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba

SHA512
034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5732955896.exe
Filesize
84KB

MD5
bd36b140501a2597a130c5d1a6105626

SHA1
ccb488217d9d32334fff09b0fb3d857e3ab4da6b

SHA256
1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

SHA512
882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

Download Submit
C:\Users\Admin\AppData\Local\Temp\5732955896.exe
Filesize
84KB

MD5
bd36b140501a2597a130c5d1a6105626

SHA1
ccb488217d9d32334fff09b0fb3d857e3ab4da6b

SHA256
1eeba0022aabfde029387b14ee7604186c8fcca857f6cd67d130df4248fe996d

SHA512
882f986e3a1f3e7d4598d9c74168076599518bc59410ceffb8c9f6143cd8a2cd72b13b584a73e12a67d43901891377dc51fec9ef649f032f1255f4c9f410f106

Download Submit
memory/1596-131-0x0000000000620000-0x000000000064A000-memory.dmp

Filesize
168KB

Download
memory/1596-132-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1596-130-0x0000000000726000-0x0000000000741000-memory.dmp

Filesize
108KB

Download
memory/1760-133-0x0000000000000000-mapping.dmp

Download
memory/2336-134-0x0000000000000000-mapping.dmp

Download
memory/3744-137-0x0000000000000000-mapping.dmp

Download
memory/3832-141-0x0000000000000000-mapping.dmp

Download
memory/4156-138-0x0000000000000000-mapping.dmp

Download
memory/4156-145-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/4156-144-0x0000000002330000-0x0000000002335000-memory.dmp

Filesize
20KB

Download
memory/4696-146-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/4788-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing