systembc | a62751453618735964f32c88d8dbf08d5e27d17b3109a2bb48a15f4ad661a372

Analysis

max time kernel
129s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62714a724abbfc87f6d3e46a446d5fbf.exe
Size

32KB
MD5

62714a724abbfc87f6d3e46a446d5fbf
SHA1

eacf4b82e080c80d1bd121bcdfc35c52a28b4f0e
SHA256

a62751453618735964f32c88d8dbf08d5e27d17b3109a2bb48a15f4ad661a372
SHA512

b4f2d8339309b6c742eb4b9027b4486b1b2dafa28c0287bd8a28df9265df7cab2dd7542e263faccc20992e8d6b89f293bae7728efb16961697706976c028e1d1
SSDEEP

768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2qKc6ziFg:YLJ8dayaaupDobnpo2RGh

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

89.248.163.218:443

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

lawwp.exe

pid process

1824 lawwp.exe

pid	process
1824	lawwp.exe

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F0892F6E-58AB-451F-837E-7E1A6CFF418C}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{ADB5CC74-BF6F-45F0-92FF-AD9869692C47}.catalogItem	svchost.exe

Drops file in Windows directory 2 IoCs

Processes:

62714a724abbfc87f6d3e46a446d5fbf.exe

description	ioc	process
File created	C:\Windows\Tasks\lawwp.job	62714a724abbfc87f6d3e46a446d5fbf.exe
File opened for modification	C:\Windows\Tasks\lawwp.job	62714a724abbfc87f6d3e46a446d5fbf.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

62714a724abbfc87f6d3e46a446d5fbf.exe

pid process

1544 62714a724abbfc87f6d3e46a446d5fbf.exe
1544 62714a724abbfc87f6d3e46a446d5fbf.exe

pid	process
1544	62714a724abbfc87f6d3e46a446d5fbf.exe
1544	62714a724abbfc87f6d3e46a446d5fbf.exe

C:\Users\Admin\AppData\Local\Temp\62714a724abbfc87f6d3e46a446d5fbf.exe
"C:\Users\Admin\AppData\Local\Temp\62714a724abbfc87f6d3e46a446d5fbf.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1544

C:\ProgramData\lnabl\lawwp.exe
C:\ProgramData\lnabl\lawwp.exe start
1⤵
- Executes dropped EXE
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\lnabl\lawwp.exe
Filesize
32KB

MD5
62714a724abbfc87f6d3e46a446d5fbf

SHA1
eacf4b82e080c80d1bd121bcdfc35c52a28b4f0e

SHA256
a62751453618735964f32c88d8dbf08d5e27d17b3109a2bb48a15f4ad661a372

SHA512
b4f2d8339309b6c742eb4b9027b4486b1b2dafa28c0287bd8a28df9265df7cab2dd7542e263faccc20992e8d6b89f293bae7728efb16961697706976c028e1d1

Download Submit
C:\ProgramData\lnabl\lawwp.exe
Filesize
32KB

MD5
62714a724abbfc87f6d3e46a446d5fbf

SHA1
eacf4b82e080c80d1bd121bcdfc35c52a28b4f0e

SHA256
a62751453618735964f32c88d8dbf08d5e27d17b3109a2bb48a15f4ad661a372

SHA512
b4f2d8339309b6c742eb4b9027b4486b1b2dafa28c0287bd8a28df9265df7cab2dd7542e263faccc20992e8d6b89f293bae7728efb16961697706976c028e1d1

Download Submit