General

  • Target

    b8cdfada8522638a45efdac45_JC.exe

  • Size

    4.1MB

  • Sample

    230728-v8b7rafc7x

  • MD5

    f0f5e6f32198fa1837b3090b7fd71fbb

  • SHA1

    bfece5be6f01f5e44b5637c6d733577d8bb64941

  • SHA256

    b8cdfada8522638a45efdac45fe27eb60b9860222d2486036e12d4a18688445b

  • SHA512

    3af3e8e5ff6cc5dc58859ba3d1f1cc9324d2b41601236749b889f0183f514bbcbe685f62910078db590f795c84fd325656c76ac154485a0a91b26204b4f27acb

  • SSDEEP

    6144:sB5f3YwKrMducTng1RxdBNE8ZOoXzeprQoXwg4kVUm+vL1kXwT/vEVelKh:If3zKrMduNndr3zDepGkVwvhHXEV00

Malware Config

Extracted

Family

systembc

C2

91.103.252.89:4317

91.103.252.57:4317

Targets

    • Target

      b8cdfada8522638a45efdac45_JC.exe

    • Size

      4.1MB

    • MD5

      f0f5e6f32198fa1837b3090b7fd71fbb

    • SHA1

      bfece5be6f01f5e44b5637c6d733577d8bb64941

    • SHA256

      b8cdfada8522638a45efdac45fe27eb60b9860222d2486036e12d4a18688445b

    • SHA512

      3af3e8e5ff6cc5dc58859ba3d1f1cc9324d2b41601236749b889f0183f514bbcbe685f62910078db590f795c84fd325656c76ac154485a0a91b26204b4f27acb

    • SSDEEP

      6144:sB5f3YwKrMducTng1RxdBNE8ZOoXzeprQoXwg4kVUm+vL1kXwT/vEVelKh:If3zKrMduNndr3zDepGkVwvhHXEV00

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Tasks