systembc | 3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c

Analysis

max time kernel
141s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2023 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e28bb0c12be9480d98e49fce8cced7b6.exe
Size

281KB
MD5

e28bb0c12be9480d98e49fce8cced7b6
SHA1

e7f2fb2ebdcd1f416422ecfc9a2e3bdf4dc2e845
SHA256

3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c
SHA512

a2edcf059ec2787c20940913c674e86e19047147c5574d129f6126d4e53c90be24526ac61f146bcab8d678f60ce4e9c017a11309921cd23642d501c9b2f78578
SSDEEP

3072:d5lYIMAbKnUtNBizA3DAbxk57Ei3LSmPI0DnMOC4YMA5ydszTgXl:2IMVUtrrl7BDnMf4HA0

Score

10^/10

systembc persistence trojan

Malware Config

Extracted

Family

systembc

admex1955x.xyz:4044

servx2785x.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e28bb0c12be9480d98e49fce8cced7b6.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run	e28bb0c12be9480d98e49fce8cced7b6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\e28bb0c12be9480d98e49fce8cced7b6.exe'\""	e28bb0c12be9480d98e49fce8cced7b6.exe

C:\Users\Admin\AppData\Local\Temp\e28bb0c12be9480d98e49fce8cced7b6.exe
"C:\Users\Admin\AppData\Local\Temp\e28bb0c12be9480d98e49fce8cced7b6.exe"
1⤵
- Adds Run key to start application
PID:4484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4484-133-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/4484-134-0x0000000000AE0000-0x0000000000AE5000-memory.dmp

Filesize
20KB

Download
memory/4484-135-0x0000000000400000-0x000000000092B000-memory.dmp

Filesize
5.2MB

Download