systembc | 640ef9afce45a61a02970462b829bf37a845948c17d72577dc70c1c21aa55b23

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEAS.640ef9afce45a61a02970462b829bf37a845948c17d72577dc70c1c21aa55b23.url
Size 204B
Sample231117-t4rafaba85
SHA256 640ef9afce45a61a02970462b829bf37a845948c17d72577dc70c1c21aa55b23
MD5 9125bafd876eda003abefbcfd3280900
SHA1 5d045bdedaae6242de78f8a89fceca748f279a0d
SHA512 69df286a83a636dbdaf9a2b0e4b30ff8b716245244f475ee945f498aadd37d5cab9edef3e1a73710d46eb4b36e99daa39bb4201b26ae149eff63896aead13111
MD5 SHA1 SHA512

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

62.173.140.37:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Blocklisted process makes network request 1 IoCs

flow	pid	Process
75	2036	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2036	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4320	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4164	4320	rundll32.exe	91
PID 4320 wrote to memory of 4164	4320	rundll32.exe	91
PID 4164 wrote to memory of 448	4164	control.exe	93
PID 4164 wrote to memory of 448	4164	control.exe	93
PID 448 wrote to memory of 2036	448	rundll32.exe	94
PID 448 wrote to memory of 2036	448	rundll32.exe	94
PID 448 wrote to memory of 2036	448	rundll32.exe	94

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\NEAS.640ef9afce45a61a02970462b829bf37a845948c17d72577dc70c1c21aa55b23.url
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\System32\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E51EX1F6\wizard[1].cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E51EX1F6\wizard[1].cpl",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E51EX1F6\wizard[1].cpl",
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wizard[1].cpl

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E51EX1F6\wizard[1].cpl
Size 16KB
SHA256 2f120d396f71ff9adb8fe11f0b529e8ddea8355837d955fed83bb0ae2a35de84
MD5 cac81707eba1be452f548e410275a0ac
SHA1 dd4b3bbd8bf357bbdeeb593e94ff0bf9b5ae19f2
SHA512 01b6b45ec3c5ef4a0162164dfd69c15b08ed37082778ef97d0f1486bc82b4b1659a90705a4d9be42b9d25c8776e20011845a9f5e4498400b11cf14a3310df8d7
SSDEEP 192:RniGhkfGBpFH+Z0hZ1WW8B52daFX4/PqfZSCG0GGGdWoBrSKja1cDHs:Y/fAeZ0hZwW42doxR3gWoBrtW1c
MD5 SHA1 SHA512 SSDEEP

Submit Download