systembc | 03c4a886c03d8eed421aa32b2df96d4b9a107d09aa5d797e69791b1b92794519

General

Target

9d8203962d8b5788b97804558e4347eb.exe
Size

1.5MB
MD5

9d8203962d8b5788b97804558e4347eb
SHA1

fbfec5c5bc40fab91e44e347d3429aa773968e06
SHA256

03c4a886c03d8eed421aa32b2df96d4b9a107d09aa5d797e69791b1b92794519
SHA512

a39ad21c40e6a623cfc1c9f8919b413af966f90e8847c2dcca7a85bca5908de0837a5ac11ba997ea0ee6e931775c0a01806b81f1f7a384d2294476c939ce6855
SSDEEP

24576:277xjRO4/1gy4+aDckmi7DaC+V+aqaGI5KMADy2n1Cpp4c7cxXZw:c7xjRJgywDCyDSWaCM0y2ngHdmu

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

89.22.225.242:4193

195.2.93.22:4193

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

Dotay forikiyi bibaja.exe

pid process

4844 Dotay forikiyi bibaja.exe

pid	process
4844	Dotay forikiyi bibaja.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9d8203962d8b5788b97804558e4347eb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9d8203962d8b5788b97804558e4347eb.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Dotay forikiyi bibaja.exe

description pid process target process

PID 4844 set thread context of 4424 4844 Dotay forikiyi bibaja.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

376 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

524 PING.EXE

description	pid	process	target process
PID 4844 set thread context of 4424	4844	Dotay forikiyi bibaja.exe	InstallUtil.exe

pid	process
376	schtasks.exe

pid	process
524	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

9d8203962d8b5788b97804558e4347eb.exeDotay forikiyi bibaja.exe

pid	process
372	9d8203962d8b5788b97804558e4347eb.exe
372	9d8203962d8b5788b97804558e4347eb.exe
372	9d8203962d8b5788b97804558e4347eb.exe
372	9d8203962d8b5788b97804558e4347eb.exe
372	9d8203962d8b5788b97804558e4347eb.exe
372	9d8203962d8b5788b97804558e4347eb.exe
372	9d8203962d8b5788b97804558e4347eb.exe
372	9d8203962d8b5788b97804558e4347eb.exe
372	9d8203962d8b5788b97804558e4347eb.exe
372	9d8203962d8b5788b97804558e4347eb.exe
4844	Dotay forikiyi bibaja.exe
4844	Dotay forikiyi bibaja.exe
4844	Dotay forikiyi bibaja.exe
4844	Dotay forikiyi bibaja.exe
4844	Dotay forikiyi bibaja.exe
4844	Dotay forikiyi bibaja.exe
4844	Dotay forikiyi bibaja.exe
4844	Dotay forikiyi bibaja.exe
4844	Dotay forikiyi bibaja.exe
4844	Dotay forikiyi bibaja.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

9d8203962d8b5788b97804558e4347eb.execmd.exeDotay forikiyi bibaja.exe

description	pid	process	target process
PID 372 wrote to memory of 376	372	9d8203962d8b5788b97804558e4347eb.exe	schtasks.exe
PID 372 wrote to memory of 376	372	9d8203962d8b5788b97804558e4347eb.exe	schtasks.exe
PID 372 wrote to memory of 376	372	9d8203962d8b5788b97804558e4347eb.exe	schtasks.exe
PID 372 wrote to memory of 4844	372	9d8203962d8b5788b97804558e4347eb.exe	Dotay forikiyi bibaja.exe
PID 372 wrote to memory of 4844	372	9d8203962d8b5788b97804558e4347eb.exe	Dotay forikiyi bibaja.exe
PID 372 wrote to memory of 4844	372	9d8203962d8b5788b97804558e4347eb.exe	Dotay forikiyi bibaja.exe
PID 372 wrote to memory of 4624	372	9d8203962d8b5788b97804558e4347eb.exe	cmd.exe
PID 372 wrote to memory of 4624	372	9d8203962d8b5788b97804558e4347eb.exe	cmd.exe
PID 372 wrote to memory of 4624	372	9d8203962d8b5788b97804558e4347eb.exe	cmd.exe
PID 4624 wrote to memory of 892	4624	cmd.exe	chcp.com
PID 4624 wrote to memory of 892	4624	cmd.exe	chcp.com
PID 4624 wrote to memory of 892	4624	cmd.exe	chcp.com
PID 4624 wrote to memory of 524	4624	cmd.exe	PING.EXE
PID 4624 wrote to memory of 524	4624	cmd.exe	PING.EXE
PID 4624 wrote to memory of 524	4624	cmd.exe	PING.EXE
PID 4844 wrote to memory of 4424	4844	Dotay forikiyi bibaja.exe	InstallUtil.exe
PID 4844 wrote to memory of 4424	4844	Dotay forikiyi bibaja.exe	InstallUtil.exe
PID 4844 wrote to memory of 4424	4844	Dotay forikiyi bibaja.exe	InstallUtil.exe
PID 4844 wrote to memory of 4424	4844	Dotay forikiyi bibaja.exe	InstallUtil.exe
PID 4844 wrote to memory of 4424	4844	Dotay forikiyi bibaja.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\9d8203962d8b5788b97804558e4347eb.exe
"C:\Users\Admin\AppData\Local\Temp\9d8203962d8b5788b97804558e4347eb.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Quabo gij cogoke pasofe melo jayiwala gohirih quocelad nocalati\Dotay forikiyi bibaja.exe"
2⤵
- Creates scheduled task(s)
PID:376

C:\Users\Admin\Quabo gij cogoke pasofe melo jayiwala gohirih quocelad nocalati\Dotay forikiyi bibaja.exe
"C:\Users\Admin\Quabo gij cogoke pasofe melo jayiwala gohirih quocelad nocalati\Dotay forikiyi bibaja.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
3⤵
PID:4424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\9d8203962d8b5788b97804558e4347eb.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:892

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Quabo gij cogoke pasofe melo jayiwala gohirih quocelad nocalati\Dotay forikiyi bibaja.exe
Filesize
612.8MB

MD5
7cb15cea37d6769b3878fcc3a027b2bc

SHA1
e5d23c72588c0ee42e0b0bf563a099577b6b09aa

SHA256
c204cfa8ae78f9bdd8d848327a4e5e2176b04b83cbd9114edbcc8d1d0ceae7c8

SHA512
640894752a71ea739b08c0e89dfc3815a4e35e0f055e34212f5af78c198c1ef3f3553d4832c5994cc9a009ab0c5cfe3f20bd70814dbe4b8f6da64afce4b9a479

Download Submit
C:\Users\Admin\Quabo gij cogoke pasofe melo jayiwala gohirih quocelad nocalati\Dotay forikiyi bibaja.exe
Filesize
631.4MB

MD5
ab9a7bc432fb40fe4b9ef0c58438b800

SHA1
48dc609f63422fccf3b8bd4063654fd147ebec34

SHA256
4024d70ded4921dc3aa3c33e8f9e429a802c560f786e9a0eb8a4f91b5d612361

SHA512
4507678020fff8aacf918a4e2367a2fb64f3578d2382b89b169f4d3190e298d8afbaacaf361466f6b13bfbd14f24b0e9347c246f441838ad0050a82c8bf6e496

Download Submit
memory/372-135-0x00000000034D5000-0x000000000363D000-memory.dmp

Filesize
1.4MB

Download
memory/372-132-0x0000000002DB0000-0x00000000034C8000-memory.dmp

Filesize
7.1MB

Download
memory/372-134-0x0000000002DB0000-0x00000000034C8000-memory.dmp

Filesize
7.1MB

Download
memory/372-133-0x00000000034D5000-0x000000000363D000-memory.dmp

Filesize
1.4MB

Download
memory/372-141-0x00000000034D5000-0x000000000363D000-memory.dmp

Filesize
1.4MB

Download
memory/376-136-0x0000000000000000-mapping.dmp

Download
memory/524-143-0x0000000000000000-mapping.dmp

Download
memory/892-142-0x0000000000000000-mapping.dmp

Download
memory/4424-150-0x0000000000000000-mapping.dmp

Download
memory/4424-156-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4424-153-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4424-151-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4624-140-0x0000000000000000-mapping.dmp

Download
memory/4844-137-0x0000000000000000-mapping.dmp

Download
memory/4844-148-0x000000000E500000-0x000000000E575000-memory.dmp

Filesize
468KB

Download
memory/4844-149-0x000000000E500000-0x000000000E575000-memory.dmp

Filesize
468KB

Download
memory/4844-147-0x0000000003426000-0x000000000358E000-memory.dmp

Filesize
1.4MB

Download
memory/4844-146-0x0000000002D01000-0x0000000003419000-memory.dmp

Filesize
7.1MB

Download
memory/4844-145-0x0000000003426000-0x000000000358E000-memory.dmp

Filesize
1.4MB

Download
memory/4844-144-0x0000000002D01000-0x0000000003419000-memory.dmp

Filesize
7.1MB

Download
memory/4844-155-0x0000000003426000-0x000000000358E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads