Overview

overview

10

Static

static

22ead9286b...55.exe

windows7-x64

10

22ead9286b...55.exe

windows10-2004-x64

Resubmissions

07-12-2022 05:42

221207-gd3jkaaa78 10

07-12-2022 05:18

221207-fzf21sbd7s 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55

  • Size

    700.4MB

  • Sample

    221207-gd3jkaaa78

  • MD5

    96319a877bcdee0b4788a88b69b1f215

  • SHA1

    6e1645c605965b20fab6775c0b676401cbbff00d

  • SHA256

    22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55

  • SHA512

    b2fcfe7a1a75b24323ba0ff96821c1561932f0c06136c4100b05eddfd667f9aecf6d488eed12c8cda52c2d9789d9120a24b7e16fc90b2c75d521563211c302c8

  • SSDEEP

    6144:/EopXhSxHralFw1nXEjb5QM0Pq5Ml2QOyAm2c84fHNArD7V/2c84fH:2rkSnXEjupPa1QdAm2lgNCDx/2lg

Score
10/10
systembcpersistencetrojan

Malware Config

Extracted

Family

systembc

C2

178.20.44.196:4127

192.168.1.149:4127

Targets

    • Target

      22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55

    • Size

      700.4MB

    • MD5

      96319a877bcdee0b4788a88b69b1f215

    • SHA1

      6e1645c605965b20fab6775c0b676401cbbff00d

    • SHA256

      22ead9286bd771170d6b0dc050c67ff487e140918e9f0b529cde4d867dee9b55

    • SHA512

      b2fcfe7a1a75b24323ba0ff96821c1561932f0c06136c4100b05eddfd667f9aecf6d488eed12c8cda52c2d9789d9120a24b7e16fc90b2c75d521563211c302c8

    • SSDEEP

      6144:/EopXhSxHralFw1nXEjb5QM0Pq5Ml2QOyAm2c84fHNArD7V/2c84fH:2rkSnXEjupPa1QdAm2lgNCDx/2lg

    Score
    10/10
    systembcpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks