systembc | 728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda

Analysis

max time kernel
292s
max time network
300s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20-07-2023 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda.exe
Size

4.8MB
MD5

a5fa62f8cb515e6aafc529b34671c6a7
SHA1

09ba2232776cdb5c41349fd50a8ddf5883fbfb85
SHA256

728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda
SHA512

0ecb161bab04660bbfcd75d01ea348a6abae3b12a5c1db42b0ee9a7a931cac1d6c931ea2db4a5dccdeb2dee39d9ba907b3e04df72b4dd79319ff818825140682
SSDEEP

12288:TeC3CZ/dn53l3lYZDGR2vK/BY3nLkpVpnG6kzv:i+m33l3lYZE2C/zG5

Score

10^/10

systembc persistence trojan

Malware Config

Extracted

Family

systembc

91.103.252.89:4317

91.103.252.57:4317

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

rxct.exe

pid process

2504 rxct.exe

pid	process
2504	rxct.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows\CurrentVersion\Run	728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda.exe'\""	728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda.exe

Drops file in Windows directory 1 IoCs

Processes:

728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda.exe

description ioc process

File created C:\Windows\Tasks\ulliigbbvwsomlhjfea.job 728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda.exe

description	ioc	process
File created	C:\Windows\Tasks\ulliigbbvwsomlhjfea.job	728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2820 wrote to memory of 2504	2820	taskeng.exe	rxct.exe
PID 2820 wrote to memory of 2504	2820	taskeng.exe	rxct.exe
PID 2820 wrote to memory of 2504	2820	taskeng.exe	rxct.exe
PID 2820 wrote to memory of 2504	2820	taskeng.exe	rxct.exe

C:\Users\Admin\AppData\Local\Temp\728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda.exe
"C:\Users\Admin\AppData\Local\Temp\728c034592a639712e51321596f4dd3c24da68fa649ffb334e12bfb48018ecda.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:3024

C:\Windows\system32\taskeng.exe
taskeng.exe {3771FF98-128D-4FBF-9C49-C2A321ACD31E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Users\Admin\AppData\Local\Temp\rxct.exe
C:\Users\Admin\AppData\Local\Temp\rxct.exe
2⤵
- Executes dropped EXE
PID:2504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rxct.exe

Filesize
4.8MB

MD5
e2ec8ec54563605f55250a2240333a0d

SHA1
20b25702b9a699cf0ed75d5c1e1c81da5ba641bf

SHA256
48329b1fbc1d5c5ff5ecb32c7bc3cb74cc68c28a8b65703687d8cd729140f963

SHA512
7a9ceb9c69d621b8341d04e8963119ac80f266d5f86b438404ae9ba1b20267524f15fcb79fea285b1505d9d5cb7bb291cba28942a4d7e98076830ce13ff48228

Download Submit
C:\Users\Admin\AppData\Local\Temp\rxct.exe

Filesize
4.8MB

MD5
e2ec8ec54563605f55250a2240333a0d

SHA1
20b25702b9a699cf0ed75d5c1e1c81da5ba641bf

SHA256
48329b1fbc1d5c5ff5ecb32c7bc3cb74cc68c28a8b65703687d8cd729140f963

SHA512
7a9ceb9c69d621b8341d04e8963119ac80f266d5f86b438404ae9ba1b20267524f15fcb79fea285b1505d9d5cb7bb291cba28942a4d7e98076830ce13ff48228

Download Submit
memory/2504-82-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2504-84-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download
memory/2504-85-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2504-86-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download
memory/3024-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3024-55-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download
memory/3024-56-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3024-58-0x0000000000400000-0x00000000008D6000-memory.dmp

Filesize
4.8MB

Download
memory/3024-57-0x00000000034B0000-0x00000000038F9000-memory.dmp

Filesize
4.3MB

Download