systembc | e2de727848662e010f6aa73d623524647cb44822ea96e1817adf9121745fb8a3

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb4c8e994d30dc8adbedf2c9535b5d04_JaffaCakes118.exe
Size

134KB
MD5

cb4c8e994d30dc8adbedf2c9535b5d04
SHA1

5b317b7b97373d0318ffd3d75487364ab6233778
SHA256

e2de727848662e010f6aa73d623524647cb44822ea96e1817adf9121745fb8a3
SHA512

f9f0ef2357350d07743ffa85bd55ae714cb40a81350c8795742aa57b0a077a6963ff41a5cc928f2b93a3eb930ce37f5d29401677fb7bd1c7a98de96018b45865
SSDEEP

3072:xuPON9on8IhFt5PUk4rdbSxbzU3AyOmp:YPON9oXp4rdbIm

Score

10^/10

systembc discovery trojan

Malware Config

Extracted

Family

systembc

advertspace10.club:4044

logstat17.club:4044

Attributes

dns
5.132.191.104

92.163.33.248

206.189.120.27

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 2 IoCs

pid	Process
2732	tuor.exe
1632	tuor.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org
7	ip4.seeip.org
5	api.ipify.org

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\tuor.job	cb4c8e994d30dc8adbedf2c9535b5d04_JaffaCakes118.exe
File created	C:\Windows\Tasks\tuor.job	cb4c8e994d30dc8adbedf2c9535b5d04_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb4c8e994d30dc8adbedf2c9535b5d04_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tuor.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2632	cb4c8e994d30dc8adbedf2c9535b5d04_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2732	2812	taskeng.exe	32
PID 2812 wrote to memory of 2732	2812	taskeng.exe	32
PID 2812 wrote to memory of 2732	2812	taskeng.exe	32
PID 2812 wrote to memory of 2732	2812	taskeng.exe	32
PID 2812 wrote to memory of 1632	2812	taskeng.exe	33
PID 2812 wrote to memory of 1632	2812	taskeng.exe	33
PID 2812 wrote to memory of 1632	2812	taskeng.exe	33
PID 2812 wrote to memory of 1632	2812	taskeng.exe	33

C:\Users\Admin\AppData\Local\Temp\cb4c8e994d30dc8adbedf2c9535b5d04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cb4c8e994d30dc8adbedf2c9535b5d04_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2632

C:\Windows\system32\taskeng.exe
taskeng.exe {F192E57D-6360-4C45-B691-D4908A19EB7F} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\ProgramData\avifpc\tuor.exe
  C:\ProgramData\avifpc\tuor.exe start2
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\ProgramData\avifpc\tuor.exe
  C:\ProgramData\avifpc\tuor.exe start2
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\avifpc\tuor.exe

Filesize
134KB

MD5
cb4c8e994d30dc8adbedf2c9535b5d04

SHA1
5b317b7b97373d0318ffd3d75487364ab6233778

SHA256
e2de727848662e010f6aa73d623524647cb44822ea96e1817adf9121745fb8a3

SHA512
f9f0ef2357350d07743ffa85bd55ae714cb40a81350c8795742aa57b0a077a6963ff41a5cc928f2b93a3eb930ce37f5d29401677fb7bd1c7a98de96018b45865

Download Submit
memory/1632-29-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1632-30-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2632-1-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2632-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2632-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2632-4-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2732-12-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2732-13-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2732-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download