systembc | f7330d13166125485e745bcbe75e8c2af7423be00c70a0765610ca86d3b01eb1

General

Target

b8e091ab0a94f3be56bbc2b66ccd653a.exe
Size

886KB
MD5

b8e091ab0a94f3be56bbc2b66ccd653a
SHA1

e62f75fcd271409e1c9eda1c60c0178247bbd3f7
SHA256

f7330d13166125485e745bcbe75e8c2af7423be00c70a0765610ca86d3b01eb1
SHA512

41a96833e498fa1fb8ab16e0e6bcd2df03d896f8460e0af6609ab757b91dd69f4394b8c676ed973a6f00545bd2c71c5a794ef9fb0bbf1f62942bddbb29db41e6

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

88.198.147.80:4174

78.47.64.46:4174

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

ahpvfg.exeahpvfg.exe

pid process

3848 ahpvfg.exe
1712 ahpvfg.exe

pid	process
3848	ahpvfg.exe
1712	ahpvfg.exe

Drops file in Windows directory 5 IoCs

Processes:

b8e091ab0a94f3be56bbc2b66ccd653a.exeahpvfg.exeb8e091ab0a94f3be56bbc2b66ccd653a.exe

description	ioc	process
File created	C:\Windows\Tasks\tcuonhgnxrrkkddjunn.job	b8e091ab0a94f3be56bbc2b66ccd653a.exe
File created	C:\Windows\Tasks\wow64.job	ahpvfg.exe
File opened for modification	C:\Windows\Tasks\wow64.job	ahpvfg.exe
File created	C:\Windows\Tasks\wow64.job	b8e091ab0a94f3be56bbc2b66ccd653a.exe
File opened for modification	C:\Windows\Tasks\wow64.job	b8e091ab0a94f3be56bbc2b66ccd653a.exe

C:\Users\Admin\AppData\Local\Temp\b8e091ab0a94f3be56bbc2b66ccd653a.exe
"C:\Users\Admin\AppData\Local\Temp\b8e091ab0a94f3be56bbc2b66ccd653a.exe"
1⤵
- Drops file in Windows directory
PID:4020

C:\Users\Admin\AppData\Local\Temp\b8e091ab0a94f3be56bbc2b66ccd653a.exe
C:\Users\Admin\AppData\Local\Temp\b8e091ab0a94f3be56bbc2b66ccd653a.exe start
1⤵
- Drops file in Windows directory
PID:3300

C:\Windows\TEMP\ahpvfg.exe
C:\Windows\TEMP\ahpvfg.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3848

C:\Windows\TEMP\ahpvfg.exe
C:\Windows\TEMP\ahpvfg.exe start
1⤵
- Executes dropped EXE
PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\TEMP\ahpvfg.exe
MD5
5fc8b735442c0761d95300c3ab2cd3f1

SHA1
0c68b66cd251825596f6a9dbcd9cd664401012c8

SHA256
36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

SHA512
a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Download Submit
C:\Windows\Tasks\wow64.job
MD5
12d6cb28c8ef1a23415a32b30c9e2f63

SHA1
afe6accdfaf598f84094b75a3448f155d4539773

SHA256
ddfa2f7c6a5016fecbd805ad62b5c5daed334800e58ba009a002988369a4c23a

SHA512
9742163d94f340571f3e64671e3d30e6cdcd5817a62dd8494c806b4b7031c9a1a93b2c40d4c8e7819420d728245fa17cab22cd9ec311cea303cddf5bff69973b

Download Submit
C:\Windows\Temp\ahpvfg.exe
MD5
5fc8b735442c0761d95300c3ab2cd3f1

SHA1
0c68b66cd251825596f6a9dbcd9cd664401012c8

SHA256
36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

SHA512
a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Download Submit
C:\Windows\Temp\ahpvfg.exe
MD5
5fc8b735442c0761d95300c3ab2cd3f1

SHA1
0c68b66cd251825596f6a9dbcd9cd664401012c8

SHA256
36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

SHA512
a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Download Submit
memory/1712-129-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1712-127-0x00000000001D0000-0x00000000001F3000-memory.dmp

Filesize
140KB

Download
memory/3300-117-0x00000000001D0000-0x00000000001F3000-memory.dmp

Filesize
140KB

Download
memory/3300-119-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3848-123-0x00000000001D0000-0x00000000001F3000-memory.dmp

Filesize
140KB

Download
memory/3848-125-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/4020-114-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4020-116-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/4020-115-0x0000000002330000-0x0000000002335000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing