systembc | cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169

Analysis

max time kernel
123s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe
Size

4.5MB
MD5

133fda00a490e613f3a6c511c1c660eb
SHA1

e34f9f1c622a7e6d3cb34217b0935ebdaab8ebe9
SHA256

cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169
SHA512

f4dd02b04326e37a3368d9c385b363689f877ae43c16de103efada642f41fe85580939db84a030597e3032d6da407d073af2b64160feec6fe38f37f1b473fffd
SSDEEP

24576:ypPiRcjGOOiX3Sl9L7MupXdagdle6whTeo5A4T9W+xjaCsyfwUmvHX+ODvz8JQDm:

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

212.162.153.199:4382

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Kaxhwswfup.vbs	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

Executes dropped EXE 2 IoCs

pid	Process
1448	$7747299f
2404	$7738088f

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 1448	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	97
PID 4040 set thread context of 2404	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	102

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3736	1448	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe
Token: SeDebugPrivilege	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 1448	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	97
PID 4040 wrote to memory of 1448	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	97
PID 4040 wrote to memory of 1448	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	97
PID 4040 wrote to memory of 1448	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	97
PID 4040 wrote to memory of 1448	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	97
PID 4040 wrote to memory of 1448	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	97
PID 4040 wrote to memory of 1448	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	97
PID 4040 wrote to memory of 1448	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	97
PID 4040 wrote to memory of 1448	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	97
PID 4040 wrote to memory of 2404	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	102
PID 4040 wrote to memory of 2404	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	102
PID 4040 wrote to memory of 2404	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	102
PID 4040 wrote to memory of 2404	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	102
PID 4040 wrote to memory of 2404	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	102
PID 4040 wrote to memory of 2404	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	102
PID 4040 wrote to memory of 2404	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	102
PID 4040 wrote to memory of 2404	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	102
PID 4040 wrote to memory of 2404	4040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	102

C:\Users\Admin\AppData\Local\Temp\cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe
"C:\Users\Admin\AppData\Local\Temp\cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Users\Admin\AppData\Local\Temp\$7747299f
  "C:\Users\Admin\AppData\Local\Temp\$7747299f"
  2⤵
  - Executes dropped EXE
  PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 420
    3⤵
    - Program crash
    PID:3736
- C:\Users\Admin\AppData\Local\Temp\$7738088f
  "C:\Users\Admin\AppData\Local\Temp\$7738088f"
  2⤵
  - Executes dropped EXE
  PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1448 -ip 1448
1⤵
PID:4112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$7747299f

Filesize
4.5MB

MD5
133fda00a490e613f3a6c511c1c660eb

SHA1
e34f9f1c622a7e6d3cb34217b0935ebdaab8ebe9

SHA256
cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169

SHA512
f4dd02b04326e37a3368d9c385b363689f877ae43c16de103efada642f41fe85580939db84a030597e3032d6da407d073af2b64160feec6fe38f37f1b473fffd

Download Submit
memory/2404-4916-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4040-38-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-1-0x0000000000810000-0x0000000000C96000-memory.dmp

Filesize
4.5MB

Download
memory/4040-4-0x0000000006C30000-0x0000000006CC2000-memory.dmp

Filesize
584KB

Download
memory/4040-5-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-20-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-26-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-34-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-46-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-60-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-68-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-66-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-64-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-62-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-58-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-56-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-54-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-0-0x000000007467E000-0x000000007467F000-memory.dmp

Filesize
4KB

Download
memory/4040-50-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-49-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-44-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-42-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-40-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-30-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-3-0x0000000007140000-0x00000000076E4000-memory.dmp

Filesize
5.6MB

Download
memory/4040-52-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-28-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-24-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-22-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-36-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-18-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-16-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-14-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-12-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-10-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-8-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-6-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-4885-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/4040-4886-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/4040-4887-0x0000000005750000-0x00000000057CE000-memory.dmp

Filesize
504KB

Download
memory/4040-4888-0x0000000006B90000-0x0000000006BDC000-memory.dmp

Filesize
304KB

Download
memory/4040-4889-0x000000007467E000-0x000000007467F000-memory.dmp

Filesize
4KB

Download
memory/4040-4890-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download
memory/4040-2-0x0000000006950000-0x0000000006B90000-memory.dmp

Filesize
2.2MB

Download
memory/4040-4904-0x0000000006F30000-0x0000000006F84000-memory.dmp

Filesize
336KB

Download
memory/4040-32-0x0000000006950000-0x0000000006B8A000-memory.dmp

Filesize
2.2MB

Download
memory/4040-4917-0x0000000074670000-0x0000000074E20000-memory.dmp

Filesize
7.7MB

Download