systembc | 7cf763f6572c30c345ee85fec8d3ae604886cfcbf101d25372f8da9a258c3f5f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa799a71a861836158017dae1fd2771ea5acc514fa7d46a84213a7b232d5bc47.exe
Size 2.1MB
Sample241018-btybws1dlq
SHA256 fa799a71a861836158017dae1fd2771ea5acc514fa7d46a84213a7b232d5bc47
MD5 68595e9cc8f567681f458a1402b8ebba
SHA1 765072c8ce12e83db831baf20ea46151967c9327
SHA512 1d3b58c99f6df476c8601b33a36873d2a8d178dcc5447dd41f369175ac2b1b09005fbce159cdf1ebce6df4ab41727003c24cb25229718fe09126d0f58d475280
SSDEEP 49152:Zs8boAvk/rdETXD/j6qYMtnz8xvMOjyPNerGSbR7Wtg2l3Zjpdc9iO:ZNboAurdEPjfzSb1WtZt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc discovery trojan

Malware Config

Extracted

Family

systembc

157.20.182.233:443

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa799a71a861836158017dae1fd2771ea5acc514fa7d46a84213a7b232d5bc47.exe

C:\Users\Admin\AppData\Local\Temp\fa799a71a861836158017dae1fd2771ea5acc514fa7d46a84213a7b232d5bc47.exe
"C:\Users\Admin\AppData\Local\Temp\fa799a71a861836158017dae1fd2771ea5acc514fa7d46a84213a7b232d5bc47.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4808-0-0x00000000006D0000-0x00000000006D5000-memory.dmp

Download