systembc | e90fa8b16a3e943baf7882ce978b4903c3012be94370e99eb0560bb8e970d682

General

Target

5350c1492b2359b71a31ba103cc19b4f.exe
Size

886KB
MD5

5350c1492b2359b71a31ba103cc19b4f
SHA1

67b81cec1269523057aac6db028b33955bffc735
SHA256

e90fa8b16a3e943baf7882ce978b4903c3012be94370e99eb0560bb8e970d682
SHA512

6d0c70987524b698bf7e8cb78cfa247078810938535ff569dd9691ed6d5e8fbea703bf62180e07e624fda13c732db226d3f2231c48e3c698e5338cfb5f253f80

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

88.198.147.80:4174

78.47.64.46:4174

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

hxjppw.exehxjppw.exehxjppw.exe

pid process

1280 hxjppw.exe
3964 hxjppw.exe
1068 hxjppw.exe

pid	process
1280	hxjppw.exe
3964	hxjppw.exe
1068	hxjppw.exe

Drops file in Windows directory 5 IoCs

Processes:

5350c1492b2359b71a31ba103cc19b4f.exehxjppw.exe5350c1492b2359b71a31ba103cc19b4f.exe

description	ioc	process
File created	C:\Windows\Tasks\bqwvqdjucntsmxfqwjp.job	5350c1492b2359b71a31ba103cc19b4f.exe
File created	C:\Windows\Tasks\wow64.job	hxjppw.exe
File opened for modification	C:\Windows\Tasks\wow64.job	hxjppw.exe
File created	C:\Windows\Tasks\wow64.job	5350c1492b2359b71a31ba103cc19b4f.exe
File opened for modification	C:\Windows\Tasks\wow64.job	5350c1492b2359b71a31ba103cc19b4f.exe

C:\Users\Admin\AppData\Local\Temp\5350c1492b2359b71a31ba103cc19b4f.exe
"C:\Users\Admin\AppData\Local\Temp\5350c1492b2359b71a31ba103cc19b4f.exe"
1⤵
- Drops file in Windows directory
PID:3904

C:\Users\Admin\AppData\Local\Temp\5350c1492b2359b71a31ba103cc19b4f.exe
C:\Users\Admin\AppData\Local\Temp\5350c1492b2359b71a31ba103cc19b4f.exe start
1⤵
- Drops file in Windows directory
PID:2168

C:\Windows\TEMP\hxjppw.exe
C:\Windows\TEMP\hxjppw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1280

C:\Windows\TEMP\hxjppw.exe
C:\Windows\TEMP\hxjppw.exe start
1⤵
- Executes dropped EXE
PID:3964

C:\Windows\TEMP\hxjppw.exe
C:\Windows\TEMP\hxjppw.exe start
1⤵
- Executes dropped EXE
PID:1068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\TEMP\hxjppw.exe
MD5
5fc8b735442c0761d95300c3ab2cd3f1

SHA1
0c68b66cd251825596f6a9dbcd9cd664401012c8

SHA256
36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

SHA512
a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Download Submit
C:\Windows\Tasks\wow64.job
MD5
750506a94274e1493b244e38fd988f45

SHA1
26757d74b495f2804693aceb770e18892c262430

SHA256
e0ff7e5e4b881a74c32b6dd96d97c962e47872eb166d4bf1306f147b7db9d9d1

SHA512
d85b5f9d2dc6fe52e76d780eb3d9293127c93a0f75bf7ecedf3b5c65619897fe080ce3b3870621531445069401280c1889102961149ef16e8a0d72667134ea02

Download Submit
C:\Windows\Temp\hxjppw.exe
MD5
5fc8b735442c0761d95300c3ab2cd3f1

SHA1
0c68b66cd251825596f6a9dbcd9cd664401012c8

SHA256
36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

SHA512
a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Download Submit
C:\Windows\Temp\hxjppw.exe
MD5
5fc8b735442c0761d95300c3ab2cd3f1

SHA1
0c68b66cd251825596f6a9dbcd9cd664401012c8

SHA256
36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

SHA512
a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Download Submit
C:\Windows\Temp\hxjppw.exe
MD5
5fc8b735442c0761d95300c3ab2cd3f1

SHA1
0c68b66cd251825596f6a9dbcd9cd664401012c8

SHA256
36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

SHA512
a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Download Submit
memory/1068-131-0x00000000001D0000-0x00000000001F3000-memory.dmp

Filesize
140KB

Download
memory/1068-133-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1068-132-0x0000000000540000-0x000000000068A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-124-0x00000000005E0000-0x000000000072A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-125-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1280-123-0x00000000001D0000-0x00000000001F3000-memory.dmp

Filesize
140KB

Download
memory/2168-119-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2168-116-0x00000000005D0000-0x00000000005D5000-memory.dmp

Filesize
20KB

Download
memory/2168-118-0x00000000001D0000-0x00000000001F3000-memory.dmp

Filesize
140KB

Download
memory/3904-117-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3904-114-0x00000000004F0000-0x000000000059E000-memory.dmp

Filesize
696KB

Download
memory/3904-115-0x00000000005B0000-0x00000000006FA000-memory.dmp

Filesize
1.3MB

Download
memory/3964-129-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download

Analysis

Sharing