SystemBC Proxy Malware in Gentlemen Ransomware Attacks: Detection and Hardening

---
title: SystemBC Proxy Persistence via Registry Run Key
id: 8a4c3e10-1b2d-4f3e-9a0d-1c2b3a4d5e6f
status: experimental
description: Detects SystemBC or similar proxy malware establishing persistence via Registry Run keys, often utilizing suspicious paths like Public or ProgramData.
references:
  - https://www.bleepingcomputer.com/news/security/the-gentlemen-ransomware-now-uses-systembc-for-bot-powered-attacks/
author: Security Arsenal
date: 2024/10/24
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_add
  product: windows
detection:
  selection:
    TargetObject|contains:
      - 'Software\Microsoft\Windows\CurrentVersion\Run'
    Details|contains:
      - 'C:\Users\Public\'
      - 'C:\ProgramData\'
  condition: selection
falsepositives:
  - Legitimate software occasionally installed in these directories by IT (rare)
level: high
---
title: Suspicious Process Execution from Public Directory
id: 9b5d4f21-2c3e-5g4f-0b1e-2d3c4e5f6a7g
status: experimental
description: Detects execution of binaries from the C:\Users\Public directory, a common drop location for SystemBC and other malware to avoid user profile restrictions.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2024/10/24
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - 'C:\Users\Public\'
      - 'C:\ProgramData\'
    Image|endswith:
      - '.exe'
  filter:
    Image|contains:
      - 'TeamViewer'
      - 'AnyDesk'
      - 'LogMeIn'
      - 'Chrome'
  condition: selection and not filter
falsepositives:
  - Administrators running tools from public shares
level: medium
---
title: SystemBC Network Connection Anomaly
id: 0c6e5g32-3d4f-6h5g-1c2f-3e4d5f6g7h8i
status: experimental
description: Detects potential SystemBC C2 activity based on suspicious processes initiating network connections to non-standard ports commonly used for proxying.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2024/10/24
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - 'C:\Users\Public\'
      - 'C:\ProgramData\'
    DestinationPort|startswith:
      - '80'
      - '443'
      - '8080'
  condition: selection
falsepositives:
  - Legitimate web browsers or update services running from unusual paths
level: high

// Hunt for SystemBC indicators: Processes running from Public/ProgramData initiating network connections
let SuspiciousPaths = dynamic(['C:\\Users\\Public\\', 'C:\\ProgramData\\']);
DeviceProcessEvents
| where FolderPath has_any (SuspiciousPaths)
| where FileName !~ "chrome.exe" and FileName !~ "firefox.exe" and FileName !~ "msedge.exe" // Browser FP reduction
| join kind=inner (
    DeviceNetworkEvents
    | where InitiatingProcessFolderPath has_any (SuspiciousPaths)
    | where RemotePort in (80, 443, 8080) // Common C2 ports
) on DeviceId, SHA256
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, SHA256
| distinct Timestamp, DeviceName, FileName, RemoteIP, RemotePort

-- Hunt for SystemBC artifacts in filesystem and processes
-- 1. Hunt for executables in Public folders
SELECT FullPath, Size, Mtime
FROM glob(globs="C:/Users/Public/**/*.exe")
WHERE NOT Name =~ "chrome.exe" AND NOT Name =~ "firefox.exe"

-- 2. Hunt for processes running from these locations
SELECT Pid, Name, Exe, Cmdline, Username
FROM pslist()
WHERE Exe =~ "C:\\Users\\Public\\" OR Exe =~ "C:\\ProgramData\\"

-- 3. Check for SystemBC specific registry persistence (Run keys)
SELECT key, value, data, mtime
FROM registry_globs(globs="HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*")
WHERE data =~ "Users\\Public" OR data =~ "ProgramData"

<#
.SYNOPSIS
    SystemBC Incident Response Script
.DESCRIPTION
    Identifies and terminates SystemBC related processes and removes persistence mechanisms.
#>

Write-Host "Starting SystemBC remediation..." -ForegroundColor Cyan

# Define suspicious paths
$SuspiciousPaths = @("C:\Users\Public", "C:\ProgramData")
$ProcessesToKill = Get-Process | Where-Object { 
    $SuspiciousPaths -contains (Split-Path $_.Path -Parent) -and 
    $_.Path -notlike "*TeamViewer*" -and 
    $_.Path -notlike "*AnyDesk*"
}

if ($ProcessesToKill) {
    Write-Host "Found suspicious processes. Terminating..." -ForegroundColor Yellow
    foreach ($proc in $ProcessesToKill) {
        try {
            Stop-Process -Id $proc.Id -Force -ErrorAction Stop
            Write-Host "Terminated process: $($proc.Path)" -ForegroundColor Green
        } catch {
            Write-Host "Failed to terminate process ID $($proc.Id): $($_.Exception.Message)" -ForegroundColor Red
        }
    }
} else {
    Write-Host "No suspicious processes found in target paths." -ForegroundColor Green
}

# Remove Registry Persistence (Run Keys)
$RunKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)

Write-Host "Checking Registry persistence..." -ForegroundColor Cyan

foreach ($key in $RunKeys) {
    if (Test-Path $key) {
        Get-Item $key | ForEach-Object {
            $_.Property | ForEach-Object {
                $propValue = (Get-ItemProperty -Path "$key\$_" -ErrorAction SilentlyContinue).$_
                if ($propValue -like "*Users\Public*" -or $propValue -like "*ProgramData*") {
                    Write-Host "Removing persistence value: $_ from $key" -ForegroundColor Yellow
                    Remove-ItemProperty -Path $key -Name $_ -Force -ErrorAction SilentlyContinue
                }
            }
        }
    }
}

Write-Host "Remediation complete. Please perform a full AV scan." -ForegroundColor Cyan