{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "SystemBC and WinSCP-based exfiltration are signature behaviors of this ransomware affiliate. Identifying these egress patterns is critical to preventing data loss."
      },
      "name": "SystemBC C2 and WinSCP Exfiltration",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1090.003",
        "attack.t1105",
        "attack.t1560.001",
        "attack.t1048.003"
      ],
      "series": {
        "slug": "blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs",
        "index": 3,
        "title": "Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs",
        "total": 3
      },
      "related": [
        {
          "hunt": "winrar-staging-behavior",
          "reason": "WinRAR archiving of file shares is a precursor to exfiltration that requires hb_file_activity monitoring.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "identity-based-lateral-movement-and-credential-access",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "This hunt pivots from the specific SystemBC staging path in Public Music to the network egress plane. It requires an analyst to correlate suspicious process execution with outbound traffic to verify exfiltration.",
      "coverage": [
        {
          "stage": "collection-and-exfiltration",
          "steps": [
            "exfiltration-activity"
          ],
          "status": "covered"
        },
        {
          "stage": "command-and-control",
          "steps": [
            "systembc-execution",
            "c2-infrastructure-connections"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-trojanized-installer",
          "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "execution-sectoprat-injection",
          "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "persistence-mechanisms",
          "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "credential-access-and-privilege-escalation",
          "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "discovery-internal-reconnaissance",
          "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "lateral-movement",
          "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "defense-evasion",
          "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Trojanized EarthTime Installer",
            "slug": "initial-access-trojanized-installer",
            "tactic": "initial-access",
            "techniques": [
              "T1204.002",
              "T1036.005"
            ],
            "observables": [
              "EarthTime.exe from Downloads folder",
              "Brave Pragmatic Network Technology Co., Ltd. revoked certificate",
              "GlobalSign GCC R45 EV CodeSigning CA 2020"
            ]
          },
          {
            "name": "SectopRAT Injection and C2 Fetch",
            "slug": "execution-sectoprat-injection",
            "tactic": "execution",
            "techniques": [
              "T1059.003",
              "T1127.001",
              "T1055"
            ],
            "observables": [
              "EarthTime.exe spawning cmd.exe spawning MSBuild.exe with no arguments",
              "Process injection into MSBuild.exe",
              "Pastebin connection for C2 configuration"
            ]
          },
          {
            "name": "Startup Shortcut and Local Account Creation",
            "slug": "persistence-mechanisms",
            "tactic": "persistence",
            "techniques": [
              "T1547.001",
              "T1136.001"
            ],
            "observables": [
              "Shortcut (.lnk) created in %AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
              "Creation of a new local account with administrative privileges"
            ]
          },
          {
            "name": "DCSync and Veeam Credential Harvesting",
            "slug": "credential-access-and-privilege-escalation",
            "tactic": "credential-access",
            "techniques": [
              "T1484.002",
              "T1003.006",
              "T1059.001"
            ],
            "observables": [
              "DCSync attack against Domain Controller",
              "PowerShell script executed on backup server to retrieve Veeam credentials"
            ]
          },
          {
            "name": "Internal Discovery Tool Deployment",
            "slug": "discovery-internal-reconnaissance",
            "tactic": "discovery",
            "techniques": [
              "T1087",
              "T1482",
              "T1018",
              "T1046"
            ],
            "observables": [
              "AdFind.exe",
              "SharpHound.exe",
              "netscan.exe (SoftPerfect)",
              "GT_NET.exe (Grixba)",
              "ipconfig",
              "nltest"
            ]
          },
          {
            "name": "Lateral Movement via RDP and PsExec",
            "slug": "lateral-movement",
            "tactic": "lateral-movement",
            "techniques": [
              "T1021.001",
              "T1570",
              "T1021.002"
            ],
            "observables": [
              "RDP connections (port 3389) using created local account and built-in Administrator",
              "PsExec used to execute SystemBC on remote hosts",
              "wmiexec used for remote reconnaissance commands"
            ]
          },
          {
            "name": "WinRAR Staging and WinSCP Exfiltration",
            "slug": "collection-and-exfiltration",
            "tactic": "exfiltration",
            "techniques": [
              "T1560.001",
              "T1048.003"
            ],
            "observables": [
              "WinRAR archiving file shares",
              "WinSCP transferring archives to cloud host via unencrypted FTP"
            ]
          },
          {
            "name": "SystemBC and Betruger C2 Infrastructure",
            "slug": "command-and-control",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003",
              "T1105"
            ],
            "observables": [
              "WakeWordEngine.dll or conhost.dll (SystemBC) in C:\\Users\\Public\\Music\\",
              "rundll32.exe calling exported Reset function",
              "Betruger backdoor deployment",
              "C2 IPs: 45.141.87.55 (9000, 15647) and 149.28.101.219 (443)"
            ]
          },
          {
            "name": "Security Tampering and Masquerading",
            "slug": "defense-evasion",
            "tactic": "defense-evasion",
            "techniques": [
              "T1562.001",
              "T1027",
              "T1036"
            ],
            "observables": [
              "Disabling Microsoft Defender protections",
              "Binaries with spoofed metadata (SentinelOne, Avast)",
              "Timestomping activities",
              "Use of C:\\Users\\Public\\Music\\ as staging directory"
            ]
          }
        ],
        "summary": "An affiliate threat actor likely linked to multiple ransomware groups used a trojanized version of the EarthTime application to deploy SectopRAT and SystemBC. They performed extensive internal discovery with tools like AdFind and Grixba, moved laterally via RDP and PsExec, and ultimately archived and exfiltrated sensitive data via WinSCP over clear-text FTP."
      },
      "severity": "high",
      "rationale": "Focus on file servers and domain controllers where SystemBC was observed in the source article. Prioritize hosts with external network egress capabilities.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary is using SystemBC for proxy tunneling and WinSCP for unencrypted FTP exfiltration from the Public Music directory to known ransomware affiliate infrastructure.",
      "parameters": {
        "c2_ips": {
          "from": {
            "ref": "dfir-report-2025-09-08",
            "kind": "article",
            "observed": "2025-09-08"
          },
          "type": "list[ip]",
          "default": [
            "45.141.87.55",
            "149.28.101.219"
          ],
          "description": "C2 infrastructure IPs associated with SystemBC and SectopRAT."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "infected_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hostnames identified as compromised in the first step; filter network queries to these systems."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/",
          "name": "DFIR Report: Blurring the Lines"
        }
      ],
      "blind_spots": [
        {
          "id": "incomplete-network-telemetry",
          "risk": "Connections to cloud providers might look like legitimate traffic if they avoid the reported IPs.",
          "stage": "command-and-control",
          "question": "whether SystemBC is using port 443 with domain-based C2 that bypasses IP filters",
          "requires": "Full network flow logs or decrypted TLS visibility"
        },
        {
          "id": "short-lived-exfiltration",
          "risk": "A quick exfiltration event may not be captured by point-in-time snapshot surfaces.",
          "stage": "collection-and-exfiltration",
          "question": "whether WinSCP was used and closed between polling intervals",
          "requires": "Process-attributed network socket logging"
        }
      ]
    },
    "name": "SystemBC C2 and WinSCP Exfiltration",
    "description": "This hunt targets the command-and-control and exfiltration phases of a ransomware affiliate operation. It identifies the execution of SystemBC payloads from the Public Music directory. It then fans out to inspect network connections for both hardcoded C2 infrastructure and unencrypted FTP activity. By correlating process execution with egress traffic, we identify the specific hosts serving as exfiltration beachheads."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs",
          "index": 3,
          "title": "Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs",
          "total": 3
        },
        "coverage": [
          {
            "stage": "collection-and-exfiltration",
            "steps": [
              "exfiltration-activity"
            ],
            "status": "covered"
          },
          {
            "stage": "command-and-control",
            "steps": [
              "systembc-execution",
              "c2-infrastructure-connections"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-trojanized-installer",
            "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "execution-sectoprat-injection",
            "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "persistence-mechanisms",
            "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "credential-access-and-privilege-escalation",
            "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "discovery-internal-reconnaissance",
            "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "lateral-movement",
            "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "defense-evasion",
            "reason": "Belongs to another part of the 'Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary is using SystemBC for proxy tunneling and WinSCP for unencrypted FTP exfiltration from the Public Music directory to known ransomware affiliate infrastructure.",
        "blind_spots": [
          {
            "id": "incomplete-network-telemetry",
            "risk": "Connections to cloud providers might look like legitimate traffic if they avoid the reported IPs.",
            "stage": "command-and-control",
            "question": "whether SystemBC is using port 443 with domain-based C2 that bypasses IP filters",
            "requires": "Full network flow logs or decrypted TLS visibility"
          },
          {
            "id": "short-lived-exfiltration",
            "risk": "A quick exfiltration event may not be captured by point-in-time snapshot surfaces.",
            "stage": "collection-and-exfiltration",
            "question": "whether WinSCP was used and closed between polling intervals",
            "requires": "Process-attributed network socket logging"
          }
        ],
        "scoping_notes": "Focus on file servers and domain controllers where SystemBC was observed in the source article. Prioritize hosts with external network egress capabilities.",
        "beyond_detection": "This hunt pivots from the specific SystemBC staging path in Public Music to the network egress plane. It requires an analyst to correlate suspicious process execution with outbound traffic to verify exfiltration."
      }
    },
    {
      "id": "systembc-execution",
      "type": "query",
      "label": "SystemBC DLL Execution via Rundll32",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%\\users\\public\\music\\%' AND LOWER(process_cmd_line) LIKE '%rundll32%' AND LOWER(process_cmd_line) LIKE '%reset%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find instances of SystemBC being launched from the Public Music directory, which is the primary staging marker for this affiliate.",
        "expected_signal": "A rundll32 process calling the Reset export on a DLL in the Music folder. This is a high-fidelity indicator of SystemBC execution."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "SystemBC DLL Execution via Rundll32",
        "reads": [
          "device_hostname",
          "process_cmd_line",
          "user_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%\\users\\public\\music\\%' AND LOWER(process_cmd_line) LIKE '%rundll32%' AND LOWER(process_cmd_line) LIKE '%reset%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "evidence_of_absence",
        "expected": "A rundll32 process calling the Reset export on a DLL in the Music folder. This is a high-fidelity indicator of SystemBC execution.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_cmd_line"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "c2-infrastructure-connections",
      "type": "query",
      "label": "SystemBC and SectopRAT C2 Connections",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE (instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0) AND ('{{infected_hosts}}' = '' OR instr(',' || '{{infected_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Verify that C2 traffic to known infrastructure is originating from the compromised hosts found in the lead step.",
        "expected_signal": "Direct outbound connections to 45.141.87.55 or 149.28.101.219 from hosts running SystemBC."
      },
      "parents": [
        {
          "id": "systembc-execution"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "SystemBC and SectopRAT C2 Connections",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "process_name",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE (instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0) AND ('{{infected_hosts}}' = '' OR instr(',' || '{{infected_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Direct outbound connections to 45.141.87.55 or 149.28.101.219 from hosts running SystemBC.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "exfiltration-activity",
      "type": "query",
      "label": "Unencrypted FTP and WinSCP Activity",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, COUNT(*) AS connection_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_port = 21 OR LOWER(process_name) LIKE '%winscp%') AND ('{{infected_hosts}}' = '' OR instr(',' || '{{infected_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip",
        "surface": "hb_network_connection",
        "description": "Attribute potential data theft to the same systems running SystemBC by looking for unencrypted FTP or WinSCP egress.",
        "expected_signal": "Connections on port 21 or from the winscp.exe process. Silence means no unencrypted exfiltration was seen on these ports."
      },
      "parents": [
        {
          "id": "systembc-execution"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Unencrypted FTP and WinSCP Activity",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "process_name",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, COUNT(*) AS connection_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_port = 21 OR LOWER(process_name) LIKE '%winscp%') AND ('{{infected_hosts}}' = '' OR instr(',' || '{{infected_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Connections on port 21 or from the winscp.exe process. Silence means no unencrypted exfiltration was seen on these ports.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "dst_endpoint_ip"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-c2-and-exfil",
      "type": "analytic",
      "label": "Triage C2 and Exfiltration Evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "systembc-execution",
          "c2-infrastructure-connections",
          "exfiltration-activity"
        ],
        "objective": "Evaluate whether the combination of SystemBC staging in Public Music and outbound connections confirm an active compromise.",
        "description": "Synthesize process staging and network egress evidence to determine if a host is active as a C2 proxy or exfiltration source.",
        "max_iterations": 4,
        "expected_signal": "A detailed verdict linking SystemBC execution to specific C2 or exfiltration destinations.",
        "success_criteria": "Verdicts for every host found in the queries."
      },
      "parents": [
        {
          "id": "c2-infrastructure-connections",
          "kind": "merge"
        },
        {
          "id": "exfiltration-activity",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on Verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-c2-and-exfil verdict is malicious for at least one host",
        "condition": "the triage-c2-and-exfil verdict is malicious for at least one host",
        "blind_spot": "incomplete-network-telemetry",
        "confidence": "high",
        "description": "Direct response based on the agent findings.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-c2-and-exfil"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate Compromised Host",
      "config": {
        "target": "endpoint",
        "description": "Sever the C2 and exfiltration connection immediately.",
        "instructions": "Isolate the host from the network. Stop the rundll32 processes identified as SystemBC. Secure the Public Music folder for forensic analysis.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "forensic-collection",
      "type": "task",
      "label": "Collect Forensic Evidence",
      "config": {
        "assignee": "analyst",
        "description": "Gather artifacts for incident response.",
        "instructions": "Collect WakeWordEngine.dll and conhost.dll from the Public Music folder. Export WinSCP connection logs and WinRAR temporary staging directories if found."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "hunt-closure",
      "type": "task",
      "label": "Hunt Closure and Reporting",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt results.",
        "instructions": "Record the findings. If SystemBC staging was detected but no network traffic was observed, increase monitoring on those hosts for lateral movement."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "forensic-collection"
        }
      ]
    }
  ]
}