systembc | 3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c

Analysis

max time kernel
141s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2023, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e28bb0c12be9480d98e49fce8cced7b6.exe
Size 281KB
Sample230619-lvg2eaec3z
SHA256 3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c
MD5 e28bb0c12be9480d98e49fce8cced7b6
SHA1 e7f2fb2ebdcd1f416422ecfc9a2e3bdf4dc2e845
SHA512 a2edcf059ec2787c20940913c674e86e19047147c5574d129f6126d4e53c90be24526ac61f146bcab8d678f60ce4e9c017a11309921cd23642d501c9b2f78578
SSDEEP 3072:d5lYIMAbKnUtNBizA3DAbxk57Ei3LSmPI0DnMOC4YMA5ydszTgXl:2IMVUtrrl7BDnMf4HA0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc persistence trojan

Malware Config

Extracted

Family

systembc

admex1955x.xyz:4044
servx2785x.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run	e28bb0c12be9480d98e49fce8cced7b6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\e28bb0c12be9480d98e49fce8cced7b6.exe'\""	e28bb0c12be9480d98e49fce8cced7b6.exe

C:\Users\Admin\AppData\Local\Temp\e28bb0c12be9480d98e49fce8cced7b6.exe
"C:\Users\Admin\AppData\Local\Temp\e28bb0c12be9480d98e49fce8cced7b6.exe"
1⤵
- Adds Run key to start application
PID:4484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4484-133-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Download

memory/4484-134-0x0000000000AE0000-0x0000000000AE5000-memory.dmp

Download

memory/4484-135-0x0000000000400000-0x000000000092B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads