Overview

overview

10

Static

static

3

d7cd8a0d00...3a.exe

windows7-x64

10

d7cd8a0d00...3a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d7cd8a0d0003d4d6fb0e9b47b5661739fe1b9e8280643c223d7537a07ad1343a.exe
  • Size 384KB
  • Sample240126-n4mpcsdad3
  • SHA256 56085286d9e9210e0a7d33c89f1e08f448e5961b59e3b228c8ef7b777272625b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
systembcdiscoverytrojan

Malware Config

Extracted

Family

  • systembc

C2

  • mdadvertx17.xyz:4044

  • pkspacex19.xyz:4044

Targets

    • Target
      d7cd8a0d0003d4d6fb0e9b47b5661739fe1b9e8280643c223d7537a07ad1343a.exe
    • Size 384KB
    • SHA256 56085286d9e9210e0a7d33c89f1e08f448e5961b59e3b228c8ef7b777272625b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    systembcdiscoverytrojan

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks