systembc | efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1

General

Target

3aad6e79569fcc68f0b8530225e08743.exe
Size

2.2MB
MD5

3aad6e79569fcc68f0b8530225e08743
SHA1

e1247952bedea6d68c471b779d673167d5e1d774
SHA256

efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1
SHA512

b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d
SSDEEP

49152:Il8pLho6EEJZHFqdBiNz0ywwO++wddZHyo:8ULxEaHr0ywwO+RZHyo

Score

10^/10

systembc evasion trojan

Malware Config

Extracted

Family

systembc

C2

cryptotab.me:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

3aad6e79569fcc68f0b8530225e08743.exeoait.exeoait.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3aad6e79569fcc68f0b8530225e08743.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oait.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oait.exe

Executes dropped EXE 2 IoCs

Processes:

oait.exeoait.exe

pid process

2212 oait.exe
2264 oait.exe

pid	process
2212	oait.exe
2264	oait.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

oait.exeoait.exe3aad6e79569fcc68f0b8530225e08743.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oait.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oait.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oait.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3aad6e79569fcc68f0b8530225e08743.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3aad6e79569fcc68f0b8530225e08743.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oait.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

3aad6e79569fcc68f0b8530225e08743.exeoait.exeoait.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine	3aad6e79569fcc68f0b8530225e08743.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine	oait.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Wine	oait.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

3aad6e79569fcc68f0b8530225e08743.exeoait.exeoait.exe

pid process

2228 3aad6e79569fcc68f0b8530225e08743.exe
2212 oait.exe
2264 oait.exe

Drops file in Windows directory 2 IoCs

Processes:

3aad6e79569fcc68f0b8530225e08743.exe

description	ioc	process
File created	C:\Windows\Tasks\oait.job	3aad6e79569fcc68f0b8530225e08743.exe
File opened for modification	C:\Windows\Tasks\oait.job	3aad6e79569fcc68f0b8530225e08743.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

3aad6e79569fcc68f0b8530225e08743.exeoait.exeoait.exe

pid	process
2228	3aad6e79569fcc68f0b8530225e08743.exe
2228	3aad6e79569fcc68f0b8530225e08743.exe
2228	3aad6e79569fcc68f0b8530225e08743.exe
2228	3aad6e79569fcc68f0b8530225e08743.exe
2212	oait.exe
2212	oait.exe
2264	oait.exe
2264	oait.exe

C:\Users\Admin\AppData\Local\Temp\3aad6e79569fcc68f0b8530225e08743.exe
"C:\Users\Admin\AppData\Local\Temp\3aad6e79569fcc68f0b8530225e08743.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2228

C:\ProgramData\tdpsv\oait.exe
C:\ProgramData\tdpsv\oait.exe start2
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2212

C:\ProgramData\tdpsv\oait.exe
C:\ProgramData\tdpsv\oait.exe start2
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2264

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\tdpsv\oait.exe
Filesize
2.2MB

MD5
3aad6e79569fcc68f0b8530225e08743

SHA1
e1247952bedea6d68c471b779d673167d5e1d774

SHA256
efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1

SHA512
b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d

Download Submit
C:\ProgramData\tdpsv\oait.exe
Filesize
2.2MB

MD5
3aad6e79569fcc68f0b8530225e08743

SHA1
e1247952bedea6d68c471b779d673167d5e1d774

SHA256
efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1

SHA512
b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d

Download Submit
C:\ProgramData\tdpsv\oait.exe
Filesize
2.2MB

MD5
3aad6e79569fcc68f0b8530225e08743

SHA1
e1247952bedea6d68c471b779d673167d5e1d774

SHA256
efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1

SHA512
b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d

Download Submit
memory/2212-141-0x00000000771B0000-0x0000000077353000-memory.dmp

Filesize
1.6MB

Download
memory/2212-143-0x00000000771B0000-0x0000000077353000-memory.dmp

Filesize
1.6MB

Download
memory/2212-140-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2212-138-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2212-139-0x00000000771B0000-0x0000000077353000-memory.dmp

Filesize
1.6MB

Download
memory/2228-133-0x00000000771B0000-0x0000000077353000-memory.dmp

Filesize
1.6MB

Download
memory/2228-134-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2228-135-0x00000000771B0000-0x0000000077353000-memory.dmp

Filesize
1.6MB

Download
memory/2228-132-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2228-142-0x00000000771B0000-0x0000000077353000-memory.dmp

Filesize
1.6MB

Download
memory/2264-145-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2264-146-0x00000000771B0000-0x0000000077353000-memory.dmp

Filesize
1.6MB

Download
memory/2264-147-0x0000000000400000-0x00000000009C3000-memory.dmp

Filesize
5.8MB

Download
memory/2264-148-0x00000000771B0000-0x0000000077353000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads