Overview

overview

10

Static

static

cd48383bef...a1.exe

windows7-x64

8

cd48383bef...a1.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cd48383befb4dce49fb855d64f500ca1.exe
  • Size 1.2MB
  • Sample221116-wr35kscc65
  • SHA256 040aa152e739826874a268f4ffb8be80dd256e7817cdb2c25329d25a5264671e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
systembctrojan

Malware Config

Extracted

Family

  • systembc

C2

  • 89.22.225.242:4193

  • 195.2.93.22:4193

Targets

    • Target
      cd48383befb4dce49fb855d64f500ca1.exe
    • Size 1.2MB
    • SHA256 040aa152e739826874a268f4ffb8be80dd256e7817cdb2c25329d25a5264671e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    systembctrojan

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks