LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S9001: SystemBC

SystemBC is a malware family offered as a malware-as-a-service (MaaS) that is used to establish command and control and facilitate follow-on activity, including ransomware deployment.SystemBC executes a variety of tasks including setting up SOCKS5 proxies, maintaining persistence, ingesting malicious files, and handing C2 communication. SystemBC was first detected in 2018, and has been used by Wizard Spider since at least 2020, and by FIN7 since at least 2022.[1][2][3][4][5]

EnterpriseS9001MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

S9001: SystemBC describes [SystemBC](https://attack.mitre.org/software/S9001) is a malware family offered as a malware-as-a-service (MaaS) that is used to establish command and control and facilitate follow-on activity, including ransomware deployment.[SystemBC](https://attack.mitre.org/software/S9001) executes a variety of tasks including setting up SOCKS5 proxies, maintaining persistence, ingesting malicious files, and handing C2 communication. [SystemBC](https://attack.mitre.org/software/S9001) was first detected in 2018, and has been us...

Executive priority

S9001: SystemBC is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S9001: SystemBC by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Linux, Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata
  • Network, endpoint, and security-tool telemetry

Detection direction

  • Validate whether S9001: SystemBC appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

SystemBC

SystemBC is a malware family offered as a malware-as-a-service (MaaS) that is used to establish command and control and facilitate follow-on activity, including ransomware deployment.SystemBC executes a variety of tasks including setting up SOCKS5 proxies, maintaining persistence, ingesting malicious files, and handing C2 communication. SystemBC was first detected in 2018, and has been used by Wizard Spider since at least 2020, and by FIN7 since at least 2022.[1][2][3][4][5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

21 rows
DomainIDNameRelationship / procedure
EnterpriseT1053.005Scheduled TaskSub-technique

SystemBC has executed a copy of itself as a scheduled task with the `start` command. The copy of SystemBC has random file and directory names within the ProgramData directory.[2][1]

EnterpriseT1059.001PowerShellSub-technique

SystemBC has used hidden scheduled tasks to execute PowerShell commands by adding the following: `-WindowStyle Hidden -ep bypass -file `.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

SystemBC has used `cmd.exe` to execute VBS scripts, BAT scripts and CMD scripts.[2]

EnterpriseT1087.001Local AccountSub-technique

SystemBC has collected the Windows account username on the victim machine.[2]

EnterpriseT1124System Time Discovery

SystemBC has leveraged the time of the device to create a text file with a filename that uses the function of `uniqid(time()).‘.txt`, consisting of the 10 character UNIX timestamp and 13 hexadecimal characters.[1]

EnterpriseT1105Ingress Tool Transfer

SystemBC has downloaded additional files for execution on the victim’s machine.[2][1] The server component of SystemBC has the ability to send additional files to victim machines.[1]

EnterpriseT1106Native API

SystemBC has utilized native Windows API functions such as `EnumWindows`and `GetVolumeInformationA` during discovery activities.[2]

EnterpriseT1140Deobfuscate/Decode Files or Information

SystemBC has the ability to decrypt RC4 encrypted packets and to decode obfuscated data before C2 communication.[4] Additionally, SystemBC has decrypted its config file that was encoded with XOR and a hardcoded 40-byte key.[5]

EnterpriseT1001Data Obfuscation

SystemBC has encoded with XOR and encrypted with RC4 its beacon.[5]

EnterpriseT1071.004DNSSub-technique

SystemBC has used DNS servers to resolve .bit domains to C2 infrastructure.CitationHarmonProofpoint_SystemBC_Aug2019

EnterpriseT1571Non-Standard Port

The server component of SystemBC has used various TCP ports for C2 communication.[1]

EnterpriseT1564.003Hidden WindowSub-technique

SystemBC has utilized the `-WindowStyle Hidden -ep bypass -file `to conceal PowerShell windows.[2]

EnterpriseT1082System Information Discovery

SystemBC has collected username , build number and serial number, then sent the information to the C2 server.[2][4] SystemBC has also gathered device name, operating system, and processor type.CitationHarmonProofpoint_SystemBC_Aug2019

EnterpriseT1090.003Multi-hop ProxySub-technique

SystemBC has used multiple proxy layers, such as SOCKS5 and Tor, for C2 communication.CitationHarmonProofpoint_SystemBC_Aug2019[2][1][3] SystemBC has also leveraged Tor for encrypting and concealing C2 traffic.[2] The server component of SystemBC has used SOCKS5 for C2 communication.[1]

EnterpriseT1480Execution Guardrails

SystemBC has checked if the last characters of DNS server names end in .bit before initializing C2 communication.CitationHarmonProofpoint_SystemBC_Aug2019 SystemBC has identified running processes associated with anti-virus solutions to include `a2guard.exe` to determine whether it executes or not.[2]

EnterpriseT1057Process Discovery

SystemBC has the ability to enumerate running processes.[2]

EnterpriseT1620Reflective Code Loading

SystemBC has downloaded a text file into memory and set the area of memory via the VirtualProtect call. Then, SystemBC has executed the file via the CreateThread call.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

SystemBC has encrypted its C2 traffic with RC4.CitationHarmonProofpoint_SystemBC_Aug2019[2]

EnterpriseT1678Delay Execution

SystemBC has leveraged the Sleep functions before and after commands to ensure execution using the hexadecimal values within commands to include `Sleep(0x2710u)` that waits 10 seconds, and `Sleep(0xEA60u)` for 60 seconds.[2]

EnterpriseT1095Non-Application Layer Protocol

SystemBC has used raw TCP on non-standard ports, such as 4044, for C2 communications and for HTTP communications, which include downloading binaries.[2][4]

EnterpriseT1059.005Visual BasicSub-technique

SystemBC has leveraged VBScript to execute malicious code.[2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

GroupEnterprise

G0117: Fox Kitten

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]

GroupEnterprise

G0102: Wizard Spider

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · GroupG0046: FIN7Enterpriseuses · GroupG0117: Fox KittenEnterpriseuses · GroupG0102: Wizard SpiderEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1001: Data ObfuscationEnterpriseuses · TechniqueT1071.004: DNSEnterpriseuses · TechniqueT1571: Non-Standard PortEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1090.003: Multi-hop ProxyEnterpriseuses · TechniqueT1480: Execution GuardrailsEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1620: Reflective Code LoadingEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1678: Delay ExecutionEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1059.005: Visual BasicEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.0
Created
Modified
Raw hash
47c0e31b8714cb3f...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.0Current bundle47c0e31b8714…
19.11.0Older bundle47c0e31b8714…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    TrumanKroll_SYSTEMBCServer_Jan2024

    Truman, D. (2024, January 19). Inside the SYSTEMBC Command-and-Control Server. Retrieved June 18, 2025.

    Open source URL
  2. [2]
    SophosGnGal_SystemBC_Dec2020

    Gallagher, S., Gn, S. (2020, December 16). Ransomware operators use SystemBC RAT as off-the-shelf Tor backdoor. Retrieved May 16, 2025.

    Open source URL
  3. [3]
    BlackBasta

    Antonio Cocomazzi and Antonio Pirozzi. (2022, November 3). Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor. Retrieved March 14, 2023.

    Open source URL
  4. [4]
    AhnLab_SystemBC_Apr2022

    AhnLab. (2022, April 4). SystemBC Being Used by Various Attackers . Retrieved June 18, 2025.

    Open source URL
  5. [5]
    Lumen_SystemBC_Sept2025

    Black Lotus Labs . (2025, September 18). SystemBC: Bringing the noise. Retrieved December 15, 2025.

    Open source URL
  6. [6]
    Broadcom_SystemBCCoroxy_Nov2023

    Broadcom. (2023, November 17). SystemBC (Coroxy) continuous activities. Retrieved December 15, 2025.

    Open source URL
  7. [7]
    Coroxy

    (Citation: BlackBasta)(Citation: Broadcom_SystemBCCoroxy_Nov2023)(Citation: Microsoft_Coroxy_Oct2020)

  8. [8]
    Microsoft_Coroxy_Oct2020

    Microsoft Security Intelligence. (2020, October 30). Backdoor:Win32/Coroxy.A. Retrieved December 15, 2025.

    Open source URL
  9. [9]
    mitre-attackS9001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use