systembc | c457750d7351711f630c4349aee88f66247a10589cd27265cf9ab916ba204626

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2023 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf89b649f21af548c8966b3ce.exe
Size

209KB
MD5

bf89b649f21af548c8966b3ce5915fb6
SHA1

397e45ea10a6e1d21c3c47a011295a7a4666dc1e
SHA256

c457750d7351711f630c4349aee88f66247a10589cd27265cf9ab916ba204626
SHA512

2f0d01b68931c2e175cc6c69891f8d6ffa61c5ce512a32b5ff8f809670338bb7e6b718566ec022576afa6b667529c7964d65cc3149c5ec6f84887d77f0c888d0
SSDEEP

3072:9NixcocAj723IKDt7e103kSrey+R0llMc9XCYz2QJz65wWFo:ScAj723HReADrgR0lyoSYCczHW

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

148.251.236.201:443

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{165D53B1-6B5B-45D6-8525-FCFF22079D06}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bf89b649f21af548c8966b3ce.exe
"C:\Users\Admin\AppData\Local\Temp\bf89b649f21af548c8966b3ce.exe"
1⤵
PID:1460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-134-0x0000000000820000-0x0000000000823000-memory.dmp

Filesize
12KB

Download
memory/1460-142-0x0000000000400000-0x00000000006DC000-memory.dmp

Filesize
2.9MB

Download