systembc | 11eaa4685ef6b2ad1a5a5e0658db510304050f0560337a1a6353355aed768719

Analysis

max time kernel
144s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stealer/BA00054A.exe
Size

33.7MB
MD5

391148ba6a49c21f1561f0b358c4adc5
SHA1

9eaf6f202172a3bdaa5ef751b9e3ed359eb4557a
SHA256

75cd90a2f1d3620498799556ea9b9217aa5048c27db0a31f6f365cf01d713bd0
SHA512

628b51c10748c0635ff3409e14546257ebee44fc45cfc48f1cb51e73d99fa8bbe7cc9e4250a5cecf6059bfbf859aacdbe12670e83103042a6eb346e21f4c4423
SSDEEP

393216:k5zFjww2tS26qtUkzgwhTlGQx2YR+1WPe6vcYEa75Y7sizuQUZ8q5q5XiMusXNRp:krOiY9TlJckPeK3P7+vDqY9VJnp

Score

10^/10

systembc vidar https://t.me/hwbhjegyuvbgyugge spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

4.8

Botnet

https://t.me/hwbhjegyuvbgyugge

https://t.me/jhfvykuwgfwekuifwbe

https://t.me/sundayevent

https://steamcommunity.com/profiles/76561198982268531

Attributes

profile_id_v2
https://t.me/hwbhjegyuvbgyugge
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Extracted

Family

systembc

91.103.252.89:4317

91.103.252.57:4317

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BA00054A.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	BA00054A.exe

Executes dropped EXE 1 IoCs

Processes:

19045882350119338091.exe

pid process

4208 19045882350119338091.exe
Loads dropped DLL 2 IoCs

Processes:

AddInProcess32.exe

pid process

2228 AddInProcess32.exe
2228 AddInProcess32.exe
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

BA00054A.exe

description ioc process

File opened (read-only) \??\F: BA00054A.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

BA00054A.exe

description pid process target process

PID 5112 set thread context of 2228 5112 BA00054A.exe AddInProcess32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4208	19045882350119338091.exe

pid	process
2228	AddInProcess32.exe
2228	AddInProcess32.exe

description	ioc	process
File opened (read-only)	\??\F:	BA00054A.exe

description	pid	process	target process
PID 5112 set thread context of 2228	5112	BA00054A.exe	AddInProcess32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AddInProcess32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AddInProcess32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

BA00054A.exepowershell.exepowershell.exepowershell.exepowershell.exeAddInProcess32.exe

pid	process
5112	BA00054A.exe
5112	BA00054A.exe
5112	BA00054A.exe
5112	BA00054A.exe
5112	BA00054A.exe
5112	BA00054A.exe
5112	BA00054A.exe
5112	BA00054A.exe
5112	BA00054A.exe
5112	BA00054A.exe
5112	BA00054A.exe
5112	BA00054A.exe
2008	powershell.exe
2008	powershell.exe
652	powershell.exe
652	powershell.exe
3920	powershell.exe
3920	powershell.exe
816	powershell.exe
816	powershell.exe
2228	AddInProcess32.exe
2228	AddInProcess32.exe
2228	AddInProcess32.exe
2228	AddInProcess32.exe
2228	AddInProcess32.exe
2228	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	652	powershell.exe
Token: SeDebugPrivilege	3920	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

BA00054A.exeAddInProcess32.exe

description	pid	process	target process
PID 5112 wrote to memory of 2008	5112	BA00054A.exe	powershell.exe
PID 5112 wrote to memory of 2008	5112	BA00054A.exe	powershell.exe
PID 5112 wrote to memory of 3628	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 3628	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 3628	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 652	5112	BA00054A.exe	powershell.exe
PID 5112 wrote to memory of 652	5112	BA00054A.exe	powershell.exe
PID 5112 wrote to memory of 3348	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 3348	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 3348	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 3920	5112	BA00054A.exe	powershell.exe
PID 5112 wrote to memory of 3920	5112	BA00054A.exe	powershell.exe
PID 5112 wrote to memory of 2228	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 2228	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 2228	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 816	5112	BA00054A.exe	powershell.exe
PID 5112 wrote to memory of 816	5112	BA00054A.exe	powershell.exe
PID 5112 wrote to memory of 2228	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 2228	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 2228	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 2228	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 2228	5112	BA00054A.exe	AddInProcess32.exe
PID 5112 wrote to memory of 2228	5112	BA00054A.exe	AddInProcess32.exe
PID 2228 wrote to memory of 4208	2228	AddInProcess32.exe	19045882350119338091.exe
PID 2228 wrote to memory of 4208	2228	AddInProcess32.exe	19045882350119338091.exe
PID 2228 wrote to memory of 4208	2228	AddInProcess32.exe	19045882350119338091.exe

C:\Users\Admin\AppData\Local\Temp\Stealer\BA00054A.exe
"C:\Users\Admin\AppData\Local\Temp\Stealer\BA00054A.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMwA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:3628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMwA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:3348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAANQA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228

C:\ProgramData\19045882350119338091.exe
"C:\ProgramData\19045882350119338091.exe"
3⤵
- Executes dropped EXE
PID:4208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAANQA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\19045882350119338091.exe
Filesize
5.2MB

MD5
bbcfd32fa72881fbf0fdcb6af640005b

SHA1
58fca49b0c320c2a6271944d699dd9c0523a18c2

SHA256
f8d00b8090bf0eeab70ab6c871f76836d37311e7546d31c1d68c1b57575aa7a6

SHA512
328f285d243141aa5569e9d9b462275b604183f14a768d2220c3bceff1fb8d82e87553f6a1f540eb3dfb706e0170f1f039d3ea8b10f3fbf1550d870e1905aa41

Download Submit
C:\ProgramData\19045882350119338091.exe
Filesize
5.2MB

MD5
bbcfd32fa72881fbf0fdcb6af640005b

SHA1
58fca49b0c320c2a6271944d699dd9c0523a18c2

SHA256
f8d00b8090bf0eeab70ab6c871f76836d37311e7546d31c1d68c1b57575aa7a6

SHA512
328f285d243141aa5569e9d9b462275b604183f14a768d2220c3bceff1fb8d82e87553f6a1f540eb3dfb706e0170f1f039d3ea8b10f3fbf1550d870e1905aa41

Download Submit
C:\ProgramData\19045882350119338091.exe
Filesize
5.2MB

MD5
bbcfd32fa72881fbf0fdcb6af640005b

SHA1
58fca49b0c320c2a6271944d699dd9c0523a18c2

SHA256
f8d00b8090bf0eeab70ab6c871f76836d37311e7546d31c1d68c1b57575aa7a6

SHA512
328f285d243141aa5569e9d9b462275b604183f14a768d2220c3bceff1fb8d82e87553f6a1f540eb3dfb706e0170f1f039d3ea8b10f3fbf1550d870e1905aa41

Download Submit
C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
3db5a3b556b01c59c5812cb86abb674e

SHA1
3848e5419d5c47879f159247e4f1b08005674cf0

SHA256
218d487f881ce9640acd16f7476b445471b83671569e99973f77d0bbf6c42ffa

SHA512
3eb6575d3e476053a65b2631b0cd0d584056ca476058ee2706c69fe10b0502460c40f8985f1f4666e42fba2809924f6dc34ba2e9b2629217542e45cb3640adcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
ff36240565e31228e0ac3db37fc65b2d

SHA1
0d807e0adfb392f8c3e024dafd45132d48e85a06

SHA256
b75e2944e2b3cbc2bfcc7bccfe94acc3d67e176badd6909733ba8d462bb4f0c5

SHA512
0eefe5759e74b873473b16f387deb0264f5ea4e8addc08129f12306c7d630e63310db5376f82cdf602cffac69e3dccea986053b5511061d3f1157a8451b98ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
ff36240565e31228e0ac3db37fc65b2d

SHA1
0d807e0adfb392f8c3e024dafd45132d48e85a06

SHA256
b75e2944e2b3cbc2bfcc7bccfe94acc3d67e176badd6909733ba8d462bb4f0c5

SHA512
0eefe5759e74b873473b16f387deb0264f5ea4e8addc08129f12306c7d630e63310db5376f82cdf602cffac69e3dccea986053b5511061d3f1157a8451b98ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3f1pgdzj.1i3.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/652-173-0x00007FF926150000-0x00007FF926C11000-memory.dmp

Filesize
10.8MB

Download
memory/652-159-0x00007FF926150000-0x00007FF926C11000-memory.dmp

Filesize
10.8MB

Download
memory/652-171-0x00000214425A0000-0x00000214425B0000-memory.dmp

Filesize
64KB

Download
memory/652-160-0x00000214425A0000-0x00000214425B0000-memory.dmp

Filesize
64KB

Download
memory/816-202-0x00007FF926150000-0x00007FF926C11000-memory.dmp

Filesize
10.8MB

Download
memory/816-189-0x00007FF926150000-0x00007FF926C11000-memory.dmp

Filesize
10.8MB

Download
memory/816-200-0x0000022152410000-0x0000022152420000-memory.dmp

Filesize
64KB

Download
memory/2008-153-0x00000171FA450000-0x00000171FA460000-memory.dmp

Filesize
64KB

Download
memory/2008-141-0x00000171FA400000-0x00000171FA422000-memory.dmp

Filesize
136KB

Download
memory/2008-154-0x00000171FA450000-0x00000171FA460000-memory.dmp

Filesize
64KB

Download
memory/2008-151-0x00007FF926150000-0x00007FF926C11000-memory.dmp

Filesize
10.8MB

Download
memory/2008-152-0x00000171FA450000-0x00000171FA460000-memory.dmp

Filesize
64KB

Download
memory/2008-157-0x00007FF926150000-0x00007FF926C11000-memory.dmp

Filesize
10.8MB

Download
memory/2228-286-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2228-268-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2228-205-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2228-215-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2228-203-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3920-188-0x00007FF926150000-0x00007FF926C11000-memory.dmp

Filesize
10.8MB

Download
memory/3920-186-0x00000162EE320000-0x00000162EE330000-memory.dmp

Filesize
64KB

Download
memory/3920-175-0x00000162EE320000-0x00000162EE330000-memory.dmp

Filesize
64KB

Download
memory/3920-174-0x00007FF926150000-0x00007FF926C11000-memory.dmp

Filesize
10.8MB

Download
memory/4208-291-0x0000000004640000-0x0000000004A89000-memory.dmp

Filesize
4.3MB

Download
memory/4208-292-0x0000000000400000-0x0000000000937000-memory.dmp

Filesize
5.2MB

Download
memory/4208-288-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4208-289-0x0000000000400000-0x0000000000937000-memory.dmp

Filesize
5.2MB

Download
memory/4208-290-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/5112-133-0x00007FF9450B0000-0x00007FF9450B2000-memory.dmp

Filesize
8KB

Download
memory/5112-135-0x00007FF7080F0000-0x00007FF70B807000-memory.dmp

Filesize
55.1MB

Download