systembc | 7dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62

General

Target

5986aff76e7813045b1b130efbb10d30.exe
Size

1.9MB
MD5

5986aff76e7813045b1b130efbb10d30
SHA1

62b1f733fe7ed0c0230c20dae3c4a65ecb28e180
SHA256

7dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62
SHA512

bfa2cad2bbbb61af7dbd22818db048ddaf68e2e22d1c55d80450a7a0c4c31c09bf596f04ebc2a7f55ac70c294ae01d3e8987af4d0bbb60c63662d21c008b3115
SSDEEP

24576:ytmVBxgdQncWHOY7XgOxv5zM44Q84u7cpS/G6bLZLI6FMPNK/bAkA/lDA:Jjou3H/Dxxr40uIB6bO6mYPAS

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

89.22.225.242:4193

195.2.93.22:4193

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

DllResource.exe

pid process

1588 DllResource.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1284 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

5986aff76e7813045b1b130efbb10d30.exe

pid process

1960 5986aff76e7813045b1b130efbb10d30.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

848 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1340 PING.EXE

pid	process
1588	DllResource.exe

pid	process
1284	cmd.exe

pid	process
848	schtasks.exe

pid	process
1340	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

5986aff76e7813045b1b130efbb10d30.exeDllResource.exe

pid	process
1960	5986aff76e7813045b1b130efbb10d30.exe
1960	5986aff76e7813045b1b130efbb10d30.exe
1960	5986aff76e7813045b1b130efbb10d30.exe
1960	5986aff76e7813045b1b130efbb10d30.exe
1960	5986aff76e7813045b1b130efbb10d30.exe
1588	DllResource.exe
1588	DllResource.exe
1588	DllResource.exe
1588	DllResource.exe
1588	DllResource.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

5986aff76e7813045b1b130efbb10d30.execmd.exe

description	pid	process	target process
PID 1960 wrote to memory of 848	1960	5986aff76e7813045b1b130efbb10d30.exe	schtasks.exe
PID 1960 wrote to memory of 848	1960	5986aff76e7813045b1b130efbb10d30.exe	schtasks.exe
PID 1960 wrote to memory of 848	1960	5986aff76e7813045b1b130efbb10d30.exe	schtasks.exe
PID 1960 wrote to memory of 848	1960	5986aff76e7813045b1b130efbb10d30.exe	schtasks.exe
PID 1960 wrote to memory of 1588	1960	5986aff76e7813045b1b130efbb10d30.exe	DllResource.exe
PID 1960 wrote to memory of 1588	1960	5986aff76e7813045b1b130efbb10d30.exe	DllResource.exe
PID 1960 wrote to memory of 1588	1960	5986aff76e7813045b1b130efbb10d30.exe	DllResource.exe
PID 1960 wrote to memory of 1588	1960	5986aff76e7813045b1b130efbb10d30.exe	DllResource.exe
PID 1960 wrote to memory of 1284	1960	5986aff76e7813045b1b130efbb10d30.exe	cmd.exe
PID 1960 wrote to memory of 1284	1960	5986aff76e7813045b1b130efbb10d30.exe	cmd.exe
PID 1960 wrote to memory of 1284	1960	5986aff76e7813045b1b130efbb10d30.exe	cmd.exe
PID 1960 wrote to memory of 1284	1960	5986aff76e7813045b1b130efbb10d30.exe	cmd.exe
PID 1284 wrote to memory of 904	1284	cmd.exe	chcp.com
PID 1284 wrote to memory of 904	1284	cmd.exe	chcp.com
PID 1284 wrote to memory of 904	1284	cmd.exe	chcp.com
PID 1284 wrote to memory of 904	1284	cmd.exe	chcp.com
PID 1284 wrote to memory of 1340	1284	cmd.exe	PING.EXE
PID 1284 wrote to memory of 1340	1284	cmd.exe	PING.EXE
PID 1284 wrote to memory of 1340	1284	cmd.exe	PING.EXE
PID 1284 wrote to memory of 1340	1284	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\5986aff76e7813045b1b130efbb10d30.exe
"C:\Users\Admin\AppData\Local\Temp\5986aff76e7813045b1b130efbb10d30.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\TypeRes\DllResource.exe"
2⤵
- Creates scheduled task(s)
PID:848

C:\Users\Admin\TypeRes\DllResource.exe
"C:\Users\Admin\TypeRes\DllResource.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1588

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\5986aff76e7813045b1b130efbb10d30.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:904

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\TypeRes\DllResource.exe
Filesize
437.8MB

MD5
03aabded8a64f014b4306f8d96d9692a

SHA1
e645a2a3c9761d6637de8c5e826967876584101b

SHA256
79fc67af8209250fe7ee4d2c73715b02211485bde17c5afea21451380c29dc55

SHA512
f99e96fdf513575a6a5375ecb32dd0684df8a1746aa56718cc55c7140fd83357b555f10801dcd679278d3bde487847d2435a32a7223958f2f3808253e467f676

Download Submit
\Users\Admin\TypeRes\DllResource.exe
Filesize
443.4MB

MD5
d172ae8074e65ae65a235e578cf2598a

SHA1
a094844f9ca02fdec550c3d44b1e760c9140f58b

SHA256
f44fc66bb23c7a65ba28090f3c99ffdc5f6f6b16c1279b57d3be14d8203a3a44

SHA512
4e016cdc56cb5bac509366c65f8639b4cc9d0859f842465c627492b7fccb88ef1e9b1fa5ebc1e59772d5f058cb60ead7d9f9a409033271b32b0e8cafe971b2a8

Download Submit
memory/848-61-0x0000000000000000-mapping.dmp

Download
memory/904-67-0x0000000000000000-mapping.dmp

Download
memory/1284-65-0x0000000000000000-mapping.dmp

Download
memory/1340-68-0x0000000000000000-mapping.dmp

Download
memory/1588-75-0x0000000000870000-0x00000000009EF000-memory.dmp

Filesize
1.5MB

Download
memory/1588-73-0x0000000000870000-0x00000000009EF000-memory.dmp

Filesize
1.5MB

Download
memory/1588-74-0x0000000001F60000-0x00000000026F0000-memory.dmp

Filesize
7.6MB

Download
memory/1588-63-0x0000000000000000-mapping.dmp

Download
memory/1588-70-0x0000000001F60000-0x00000000026F0000-memory.dmp

Filesize
7.6MB

Download
memory/1588-76-0x000000000AF00000-0x000000000AF91000-memory.dmp

Filesize
580KB

Download
memory/1588-71-0x0000000000870000-0x00000000009EF000-memory.dmp

Filesize
1.5MB

Download
memory/1588-77-0x0000000000A10000-0x0000000000A17000-memory.dmp

Filesize
28KB

Download
memory/1588-80-0x000000000AF00000-0x000000000AF91000-memory.dmp

Filesize
580KB

Download
memory/1588-69-0x0000000001F60000-0x00000000026F0000-memory.dmp

Filesize
7.6MB

Download
memory/1960-60-0x00000000025C0000-0x000000000273F000-memory.dmp

Filesize
1.5MB

Download
memory/1960-66-0x00000000025C0000-0x000000000273F000-memory.dmp

Filesize
1.5MB

Download
memory/1960-54-0x0000000001E30000-0x00000000025C0000-memory.dmp

Filesize
7.6MB

Download
memory/1960-59-0x0000000001E30000-0x00000000025C0000-memory.dmp

Filesize
7.6MB

Download
memory/1960-58-0x00000000025C0000-0x000000000273F000-memory.dmp

Filesize
1.5MB

Download
memory/1960-57-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1960-56-0x00000000025C0000-0x000000000273F000-memory.dmp

Filesize
1.5MB

Download
memory/1960-55-0x0000000001E30000-0x00000000025C0000-memory.dmp

Filesize
7.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads