systembc | 3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1

General

Target

3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe
Size

563KB
MD5

6ea1172020965edb4537d792d9708895
SHA1

3172fde93fdda132c70993e38d323e81dc2a1574
SHA256

3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1
SHA512

3e09f7dd203017ef1e7c32e91e3f434602199ddcbd662e9fc998d7e47a5540f823e93f47ede04052645aaddcab0a6ae38613ac5ccc640b22edcb5e6a951361a2
SSDEEP

6144:xKYFmTP4ym4mEca4GtqLA3/3E3I4CmV9X1edcqeofiaO5kkRgVY2t6ta:YYqmERtq0vE3Ixm9UfP/5tW

Score

10^/10

systembc persistence trojan

Malware Config

Extracted

Family

systembc

C2

kmstat95dx.xyz:4044

kmstat355mx.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MSBuild.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe'\""	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe

description	pid	process	target process
PID 2680 set thread context of 1216	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe

pid	process
2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe
2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe

description pid process

Token: SeDebugPrivilege 2680 3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe

description	pid	process
Token: SeDebugPrivilege	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe

description	pid	process	target process
PID 2680 wrote to memory of 1280	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1280	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1280	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1216	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1216	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1216	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1216	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1216	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1216	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1216	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1216	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe
PID 2680 wrote to memory of 1216	2680	3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3c94a2599ff2c5b3103ac608e578a7ee477527097cd19e0f1e64d38d5366eae1exe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
2⤵
PID:1280

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
2⤵
- Adds Run key to start application
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-1223-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2680-166-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-142-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-172-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-137-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/2680-138-0x0000000005250000-0x000000000525A000-memory.dmp

Filesize
40KB

Download
memory/2680-139-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-140-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-170-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-144-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-146-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-148-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-150-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-168-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-154-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-156-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-158-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-160-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-162-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-164-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-134-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download
memory/2680-152-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-135-0x0000000005590000-0x0000000005B34000-memory.dmp

Filesize
5.6MB

Download
memory/2680-136-0x00000000050C0000-0x0000000005152000-memory.dmp

Filesize
584KB

Download
memory/2680-174-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-176-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-178-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-180-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-182-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-184-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-186-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-188-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-190-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-192-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-194-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-196-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-198-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-200-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-202-0x0000000007A80000-0x0000000007B2F000-memory.dmp

Filesize
700KB

Download
memory/2680-1215-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download
memory/2680-1216-0x0000000007150000-0x0000000007151000-memory.dmp

Filesize
4KB

Download
memory/2680-133-0x0000000000610000-0x00000000006A4000-memory.dmp

Filesize
592KB

Download
memory/2680-1222-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads