systembc | 09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc

Resubmissions

17-04-2024 12:47

240417-p1aq3ahc4w 10

17-04-2024 12:47

17-04-2024 12:47

17-04-2024 12:46

17-04-2024 12:46

17-04-2024 06:16

Analysis

max time kernel
300s
max time network
311s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
Size

221KB
MD5

364d59e179ebcd469dce4f231789732d
SHA1

bc86ba43147fe0d301a32b66193dd2930b8af1d2
SHA256

09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc
SHA512

92ae882cb803b23dc344a42b07ffcc77999f71dcd6b7bf1d2ca7e7306a7642543a2cc85f2bdf18df67151a8b2145509363b2552d4e5361715bc55b934db046fe
SSDEEP

6144:0YlvDFWQtzoa2gUayZSSnBcaa5MKmtVgykK:BNtzPqUgkNM4

Score

10^/10

systembc trojan upx

Malware Config

Extracted

Family

systembc

yan0212.com:4039

yan0212.net:4039

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

mmgjmf.exe

pid process

4692 mmgjmf.exe

pid	process
4692	mmgjmf.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\ProgramData\fdrui\mmgjmf.exe	upx

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

30 api.ipify.org
31 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

flow	ioc
30	api.ipify.org
31	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe

description	ioc	process
File created	C:\Windows\Tasks\mmgjmf.job	09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
File opened for modification	C:\Windows\Tasks\mmgjmf.job	09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2388 4784 WerFault.exe 09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe

pid	pid_target	process	target process
2388	4784	WerFault.exe	09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe

pid	process
4784	09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
4784	09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe

C:\Users\Admin\AppData\Local\Temp\09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
"C:\Users\Admin\AppData\Local\Temp\09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 484
2⤵
- Program crash
PID:2388

C:\ProgramData\fdrui\mmgjmf.exe
C:\ProgramData\fdrui\mmgjmf.exe start
1⤵
- Executes dropped EXE
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2368 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4784 -ip 4784
1⤵
PID:60

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Proxy

T1090

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\fdrui\mmgjmf.exe
Filesize
221KB

MD5
364d59e179ebcd469dce4f231789732d

SHA1
bc86ba43147fe0d301a32b66193dd2930b8af1d2

SHA256
09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc

SHA512
92ae882cb803b23dc344a42b07ffcc77999f71dcd6b7bf1d2ca7e7306a7642543a2cc85f2bdf18df67151a8b2145509363b2552d4e5361715bc55b934db046fe

Download Submit
memory/4692-9-0x0000000005530000-0x0000000005536000-memory.dmp

Filesize
24KB

Download
memory/4692-10-0x0000000005540000-0x0000000005549000-memory.dmp

Filesize
36KB

Download
memory/4692-12-0x0000000000400000-0x0000000004C6C000-memory.dmp

Filesize
72.4MB

Download
memory/4784-0-0x0000000004DD0000-0x0000000004DD6000-memory.dmp

Filesize
24KB

Download
memory/4784-1-0x0000000004DE0000-0x0000000004DE9000-memory.dmp

Filesize
36KB

Download
memory/4784-2-0x0000000000400000-0x0000000004C6C000-memory.dmp

Filesize
72.4MB

Download