systembc | 3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e28bb0c12be9480d98e49fce8cced7b6.exe
Size

281KB
MD5

e28bb0c12be9480d98e49fce8cced7b6
SHA1

e7f2fb2ebdcd1f416422ecfc9a2e3bdf4dc2e845
SHA256

3c8aec76ac1f6c07f332c3f9a80c4c3c93c5f809b58dfed8abdb6a644e13c57c
SHA512

a2edcf059ec2787c20940913c674e86e19047147c5574d129f6126d4e53c90be24526ac61f146bcab8d678f60ce4e9c017a11309921cd23642d501c9b2f78578
SSDEEP

3072:d5lYIMAbKnUtNBizA3DAbxk57Ei3LSmPI0DnMOC4YMA5ydszTgXl:2IMVUtrrl7BDnMf4HA0

Score

10^/10

systembc discovery persistence trojan

Malware Config

Extracted

Family

systembc

admex1955x.xyz:4044

servx2785x.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Systembc family
systembc

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e28bb0c12be9480d98e49fce8cced7b6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\e28bb0c12be9480d98e49fce8cced7b6.exe'\""	e28bb0c12be9480d98e49fce8cced7b6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

e28bb0c12be9480d98e49fce8cced7b6.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e28bb0c12be9480d98e49fce8cced7b6.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e28bb0c12be9480d98e49fce8cced7b6.exe

C:\Users\Admin\AppData\Local\Temp\e28bb0c12be9480d98e49fce8cced7b6.exe
"C:\Users\Admin\AppData\Local\Temp\e28bb0c12be9480d98e49fce8cced7b6.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3232-0-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

Filesize
84KB

Download
memory/3232-1-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

Filesize
84KB

Download
memory/3232-2-0x0000000000AF0000-0x0000000000AF5000-memory.dmp

Filesize
20KB

Download
memory/3232-3-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3232-4-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

Filesize
84KB

Download
memory/3232-5-0x0000000000AF0000-0x0000000000AF5000-memory.dmp

Filesize
20KB

Download
memory/3232-6-0x0000000000400000-0x000000000092B000-memory.dmp

Filesize
5.2MB

Download