systembc | c69ab262ac3f73277c4b9a777a408f57feb618e2e00bc2e66e8d97274083c742

Analysis

max time kernel
95s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c69ab262ac3f73277c4b9a777a408f57feb618e2e00bc2e66e8d97274083c742.exe
Size

459KB
MD5

422ebc5203d2a74ff0c73f08d581c3a0
SHA1

752b86b58860377d0ed1f9570b1ed1324d3c4f2e
SHA256

c69ab262ac3f73277c4b9a777a408f57feb618e2e00bc2e66e8d97274083c742
SHA512

9313b1b0c3421e1825fde593bdb3cae293931d6ce8c241fa11ccc67305e16a357cf9256f37cb9ae505697edbce63444f3b3917be86d780b4f9c29baba37b1264
SSDEEP

12288:ztBTQkfHSxBcu/Jdxq0rNIQ23nGbEbOKKSsMDxACqUBd:AMu/M0rWQ23nGsUSfDxAl

Score

10^/10

systembc discovery persistence trojan

Malware Config

Extracted

Family

systembc

212.232.22.140:443

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c69ab262ac3f73277c4b9a777a408f57feb618e2e00bc2e66e8d97274083c742.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\c69ab262ac3f73277c4b9a777a408f57feb618e2e00bc2e66e8d97274083c742.exe'\""	c69ab262ac3f73277c4b9a777a408f57feb618e2e00bc2e66e8d97274083c742.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c69ab262ac3f73277c4b9a777a408f57feb618e2e00bc2e66e8d97274083c742.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c69ab262ac3f73277c4b9a777a408f57feb618e2e00bc2e66e8d97274083c742.exe

C:\Users\Admin\AppData\Local\Temp\c69ab262ac3f73277c4b9a777a408f57feb618e2e00bc2e66e8d97274083c742.exe
"C:\Users\Admin\AppData\Local\Temp\c69ab262ac3f73277c4b9a777a408f57feb618e2e00bc2e66e8d97274083c742.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3232-0-0x0000000002200000-0x0000000002205000-memory.dmp

Filesize
20KB

Download
memory/3232-2-0x0000000002200000-0x0000000002205000-memory.dmp

Filesize
20KB

Download