systembc | 304a6ae31de8154aaf18fa3ba46f4d768a68fabaca443868e1a447e6e51cfc26

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2eaa3485a9efff93e652cb5e3fef2bddaa1e631d2abc258a66f3d3b7f09f3de.exe
Size

873KB
MD5

7c14e45f1b37c59138cafd3173e7acd5
SHA1

7ea141eb9f013e0dce8ee2b6a692153fefbcbb3a
SHA256

a2eaa3485a9efff93e652cb5e3fef2bddaa1e631d2abc258a66f3d3b7f09f3de
SHA512

52ce187cc850430f1710e898cf28a5f3a770f3a972f94f6c6c68c6e0042a5dd79b7451dbc95121dee4c0f005dbee2ccfa0aa8fc1850f3d66d7cd6c6c5a61490c
SSDEEP

3072:LgfqAxp7Trv/hQjtXCIiXZUiq9UlRLTTFfD8:EfbfTbpOCVXzDLL/Fr8

Score

10^/10

systembc discovery trojan

Malware Config

Extracted

Family

systembc

179.43.178.96:4141

192.168.1.149:4141

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Systembc family
systembc

Executes dropped EXE 1 IoCs

pid	Process
4320	skqwek.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skqwek.job	a2eaa3485a9efff93e652cb5e3fef2bddaa1e631d2abc258a66f3d3b7f09f3de.exe
File opened for modification	C:\Windows\Tasks\skqwek.job	a2eaa3485a9efff93e652cb5e3fef2bddaa1e631d2abc258a66f3d3b7f09f3de.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2eaa3485a9efff93e652cb5e3fef2bddaa1e631d2abc258a66f3d3b7f09f3de.exe

C:\Users\Admin\AppData\Local\Temp\a2eaa3485a9efff93e652cb5e3fef2bddaa1e631d2abc258a66f3d3b7f09f3de.exe
"C:\Users\Admin\AppData\Local\Temp\a2eaa3485a9efff93e652cb5e3fef2bddaa1e631d2abc258a66f3d3b7f09f3de.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:32

C:\ProgramData\bvtr\skqwek.exe
C:\ProgramData\bvtr\skqwek.exe start
1⤵
- Executes dropped EXE
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\bvtr\skqwek.exe

Filesize
873KB

MD5
7c14e45f1b37c59138cafd3173e7acd5

SHA1
7ea141eb9f013e0dce8ee2b6a692153fefbcbb3a

SHA256
a2eaa3485a9efff93e652cb5e3fef2bddaa1e631d2abc258a66f3d3b7f09f3de

SHA512
52ce187cc850430f1710e898cf28a5f3a770f3a972f94f6c6c68c6e0042a5dd79b7451dbc95121dee4c0f005dbee2ccfa0aa8fc1850f3d66d7cd6c6c5a61490c

Download Submit
memory/32-0-0x0000000002220000-0x0000000002225000-memory.dmp

Filesize
20KB

Download
memory/32-1-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/32-5-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/32-4-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/4320-9-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/4320-10-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download