Overview

overview

10

Static

static

3

06063b690d...77.exe

windows10-2004-x64

10

06063b690d...77.exe

windows7-x64

10

06063b690d...77.exe

windows10-1703-x64

10

06063b690d...77.exe

windows10-2004-x64

7

06063b690d...77.exe

windows11-21h2-x64

7

$PLUGINSDI...em.dll

windows10-1703-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-1703-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

Resubmissions

18-04-2024 11:46

240418-nxbcraca34 10

18-04-2024 11:45

240418-nw8a4adb71 10

18-04-2024 11:45

240418-nw7pkadb7x 10

18-04-2024 11:45

240418-nw2tbabh97 10

18-04-2024 11:45

240418-nw17sabh96 10

18-04-2024 10:00

240418-l12m1ahg84 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77

  • Size

    192KB

  • Sample

    240418-nw2tbabh97

  • MD5

    610b4e85369410c52cd2c1f1c1b304ae

  • SHA1

    1a1288380b4abddb9830ff22541583ba66f76f2c

  • SHA256

    06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77

  • SHA512

    46deda3922aff6aed04591aac09be1408798fc8e6d58ace5f9dca92ec33583b86ecf4b1fe52696f8128fd50cc27f14485cdc1bd51339788964d39f323d171c3a

  • SSDEEP

    3072:rf1BDZ0kVB67Duw9AMc+bP1Yf0wK8F78CrLFOmvJfnah+vbkWS90tqNu/mOspgI:r9X0GgP1k0I84Loafnah+TJqNfppJ

Score
10/10
systembctrojan

Malware Config

Extracted

Family

systembc

C2

172.104.63.157:4001

Targets

    • Target

      06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77

    • Size

      192KB

    • MD5

      610b4e85369410c52cd2c1f1c1b304ae

    • SHA1

      1a1288380b4abddb9830ff22541583ba66f76f2c

    • SHA256

      06063b690db71cc96cc36b528e7a8fa599046491f976e94615392975b96b0d77

    • SHA512

      46deda3922aff6aed04591aac09be1408798fc8e6d58ace5f9dca92ec33583b86ecf4b1fe52696f8128fd50cc27f14485cdc1bd51339788964d39f323d171c3a

    • SSDEEP

      3072:rf1BDZ0kVB67Duw9AMc+bP1Yf0wK8F78CrLFOmvJfnah+vbkWS90tqNu/mOspgI:r9X0GgP1k0I84Loafnah+TJqNfppJ

    Score
    10/10
    systembctrojan

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4behavioral5

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      fccff8cb7a1067e23fd2e2b63971a8e1

    • SHA1

      30e2a9e137c1223a78a0f7b0bf96a1c361976d91

    • SHA256

      6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

    • SHA512

      f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

    • SSDEEP

      192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4

    Score
    3/10
    behavioral10behavioral6behavioral7behavioral8behavioral9

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Proxy

1
T1090

Impact

Resource Development

Reconnaissance

Tasks