Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file

  • Size

    263KB

  • Sample

    230605-zk5xdaag64

  • MD5

    00e2db89532040c67ffd107ce99200ff

  • SHA1

    ecfa050c622f9a8937c241f4612b18e71a10b37f

  • SHA256

    4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328

  • SHA512

    e0db858ada8ab45ce009db7cdc3613496951cc9c27b68dec72586d68dbf605e43e9a4a616418710065a121046c8d03eb77b9131522677d1d1e527ce1b7e89b47

  • SSDEEP

    3072:BgU/XdoE8Rk3EXyEx6lnortV5sEqirdUkx+uzyHvP0AwpRPfMvgpm9jDQi9j0dUR:WUVogdlqP5SLyyEVRPfMJQiUA

Score
10/10
systembctrojan

Malware Config

Extracted

Family

systembc

C2

23.95.44.228:53

Targets

    • Target

      file

    • Size

      263KB

    • MD5

      00e2db89532040c67ffd107ce99200ff

    • SHA1

      ecfa050c622f9a8937c241f4612b18e71a10b37f

    • SHA256

      4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328

    • SHA512

      e0db858ada8ab45ce009db7cdc3613496951cc9c27b68dec72586d68dbf605e43e9a4a616418710065a121046c8d03eb77b9131522677d1d1e527ce1b7e89b47

    • SSDEEP

      3072:BgU/XdoE8Rk3EXyEx6lnortV5sEqirdUkx+uzyHvP0AwpRPfMvgpm9jDQi9j0dUR:WUVogdlqP5SLyyEVRPfMJQiUA

    Score
    10/10
    systembctrojan

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks