systembc | a28ddf7248cb96a79b5b4b4d942dbdcffb3f81ced96f2810a1718ebd90eb6000

General

Target

9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
Size

472KB
MD5

9e621faf9f9d751999f1193c02ca5577
SHA1

9fa5239819f052bac418c0c6be4d93530ab6439d
SHA256

a28ddf7248cb96a79b5b4b4d942dbdcffb3f81ced96f2810a1718ebd90eb6000
SHA512

68ff72eadd0a8df27a6a3d1e89bb27026140687a6dd0d94dbd53ccfba3f8a26721347cc410234d4b7ae63796bfec582332fbd01d50685d2e302f3b0d3a96c503
SSDEEP

12288:/y50zvBXPNefIIjliHmgtX8ujE6kpfjBzHTChE:o0GvinIDfjxz4

Score

10^/10

systembc discovery trojan

Malware Config

Extracted

Family

systembc

C2

paladin5.com

Attributes

dns
5.132.191.104

ns1.vic.au.dns.opennic.glue

ns2.vic.au.dns.opennic.glue

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 1 IoCs

pid	Process
2744	kpeh.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\proc.dmp	kpeh.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\corolina17.job	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
File opened for modification	C:\Windows\Tasks\corolina17.job	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kpeh.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
2744	kpeh.exe
2744	kpeh.exe
2744	kpeh.exe
2744	kpeh.exe
2744	kpeh.exe
2744	kpeh.exe
2744	kpeh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
Token: SeShutdownPrivilege	2744	kpeh.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
2744	kpeh.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3060	9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
2744	kpeh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2744	2828	taskeng.exe	31
PID 2828 wrote to memory of 2744	2828	taskeng.exe	31
PID 2828 wrote to memory of 2744	2828	taskeng.exe	31
PID 2828 wrote to memory of 2744	2828	taskeng.exe	31

C:\Users\Admin\AppData\Local\Temp\9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e621faf9f9d751999f1193c02ca5577_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3060

C:\Windows\system32\taskeng.exe
taskeng.exe {E557E507-B8EF-49D2-9734-DD569EF8A081} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\ProgramData\vcxignh\kpeh.exe
  C:\ProgramData\vcxignh\kpeh.exe start2
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcxignh\kpeh.exe

Filesize
472KB

MD5
9e621faf9f9d751999f1193c02ca5577

SHA1
9fa5239819f052bac418c0c6be4d93530ab6439d

SHA256
a28ddf7248cb96a79b5b4b4d942dbdcffb3f81ced96f2810a1718ebd90eb6000

SHA512
68ff72eadd0a8df27a6a3d1e89bb27026140687a6dd0d94dbd53ccfba3f8a26721347cc410234d4b7ae63796bfec582332fbd01d50685d2e302f3b0d3a96c503

Download Submit
memory/2744-30-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2744-28-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2744-27-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2744-26-0x00000000004C0000-0x00000000004E0000-memory.dmp

Filesize
128KB

Download
memory/3060-7-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/3060-9-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/3060-10-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/3060-11-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/3060-12-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/3060-13-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/3060-17-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3060-8-0x0000000000810000-0x0000000000830000-memory.dmp

Filesize
128KB

Download
memory/3060-3-0x0000000000810000-0x0000000000830000-memory.dmp

Filesize
128KB

Download
memory/3060-6-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/3060-5-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/3060-4-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/3060-35-0x0000000000810000-0x0000000000830000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing