systembc | 8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92

Analysis

max time kernel
292s
max time network
303s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
20-07-2023 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe
Size

4.8MB
MD5

0b4e2d65448cb900ec1d64ea564de052
SHA1

d1348e11bf46327def51ff5c892894f9cb66e501
SHA256

8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92
SHA512

ead754d3337b40f7fd2d5820e888112d37824523b2000f847ef805ae9fc1a519c11fbd7f8c5a108b6275479d78ac21ae7a517a79456e0f9ce9b22713deda5d46
SSDEEP

12288:TeC3CZ/dn53l3lYZDGR2vK/BY3nLkpVpnG6kzD:i+m33l3lYZE2C/zG5

Score

10^/10

systembc persistence trojan

Malware Config

Extracted

Family

systembc

91.103.252.89:4317

91.103.252.57:4317

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

cwtiwn.exe

pid process

3012 cwtiwn.exe

pid	process
3012	cwtiwn.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3229013990-3330391637-2814184332-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe'\""	8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe
Key created	\REGISTRY\USER\S-1-5-21-3229013990-3330391637-2814184332-1000\Software\Microsoft\Windows\CurrentVersion\Run	8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe

Drops file in Windows directory 1 IoCs

Processes:

8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe

description ioc process

File created C:\Windows\Tasks\odcogxqjcunfwphaskd.job 8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe

description	ioc	process
File created	C:\Windows\Tasks\odcogxqjcunfwphaskd.job	8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe

C:\Users\Admin\AppData\Local\Temp\8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe
"C:\Users\Admin\AppData\Local\Temp\8b399f768287de13f64a468c4b57e19f5867d29b9e8906d070844b430166ea92.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:4448

C:\Users\Admin\AppData\Local\Temp\cwtiwn.exe
C:\Users\Admin\AppData\Local\Temp\cwtiwn.exe
1⤵
- Executes dropped EXE
PID:3012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cwtiwn.exe

Filesize
4.8MB

MD5
e2ec8ec54563605f55250a2240333a0d

SHA1
20b25702b9a699cf0ed75d5c1e1c81da5ba641bf

SHA256
48329b1fbc1d5c5ff5ecb32c7bc3cb74cc68c28a8b65703687d8cd729140f963

SHA512
7a9ceb9c69d621b8341d04e8963119ac80f266d5f86b438404ae9ba1b20267524f15fcb79fea285b1505d9d5cb7bb291cba28942a4d7e98076830ce13ff48228

Download Submit
C:\Users\Admin\AppData\Local\Temp\cwtiwn.exe

Filesize
4.8MB

MD5
e2ec8ec54563605f55250a2240333a0d

SHA1
20b25702b9a699cf0ed75d5c1e1c81da5ba641bf

SHA256
48329b1fbc1d5c5ff5ecb32c7bc3cb74cc68c28a8b65703687d8cd729140f963

SHA512
7a9ceb9c69d621b8341d04e8963119ac80f266d5f86b438404ae9ba1b20267524f15fcb79fea285b1505d9d5cb7bb291cba28942a4d7e98076830ce13ff48228

Download Submit
memory/3012-144-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3012-146-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download
memory/3012-147-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3012-148-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download
memory/4448-117-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4448-118-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download
memory/4448-119-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4448-120-0x00000000044D0000-0x0000000004919000-memory.dmp

Filesize
4.3MB

Download
memory/4448-121-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download