systembc | 32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06

General

Target

32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06.exe
Size

423KB
MD5

ab52b38a4f5393e5bf919b75c0abdbdf
SHA1

1fe162d6461405f7bd2c8def91e547cf85b28638
SHA256

32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06
SHA512

c7cbf5bbba6c6b4e5069ea0f5b6343e771cfd86f6a1295d7b9b653465f3068ac0a5c9492a89f38ac81db92879642dbab8943507a72438223690bacb291d8cdbc

Score

10^/10

systembc dave trojan

Malware Config

Extracted

Family

systembc

C2

88.119.174.113:443

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Dave packer 1 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

dave

Processes:

resource	yara_rule
behavioral2/memory/3276-135-0x00000000005A0000-0x00000000005AB000-memory.dmp	dave

Executes dropped EXE 1 IoCs

Processes:

qlnst.exe

pid process

4916 qlnst.exe

pid	process
4916	qlnst.exe

Drops file in Windows directory 7 IoCs

Processes:

32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06.exesvchost.exe

description	ioc	process
File created	C:\Windows\Tasks\qlnst.job	32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06.exe
File opened for modification	C:\Windows\Tasks\qlnst.job	32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06.exe

pid	process
3276	32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06.exe
3276	32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	5112	svchost.exe
Token: SeCreatePagefilePrivilege	5112	svchost.exe
Token: SeShutdownPrivilege	5112	svchost.exe
Token: SeCreatePagefilePrivilege	5112	svchost.exe
Token: SeShutdownPrivilege	5112	svchost.exe
Token: SeCreatePagefilePrivilege	5112	svchost.exe

C:\Users\Admin\AppData\Local\Temp\32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06.exe
"C:\Users\Admin\AppData\Local\Temp\32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3276

C:\ProgramData\pedp\qlnst.exe
C:\ProgramData\pedp\qlnst.exe start
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\pedp\qlnst.exe
MD5
ab52b38a4f5393e5bf919b75c0abdbdf

SHA1
1fe162d6461405f7bd2c8def91e547cf85b28638

SHA256
32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06

SHA512
c7cbf5bbba6c6b4e5069ea0f5b6343e771cfd86f6a1295d7b9b653465f3068ac0a5c9492a89f38ac81db92879642dbab8943507a72438223690bacb291d8cdbc

Download Submit
C:\ProgramData\pedp\qlnst.exe
MD5
ab52b38a4f5393e5bf919b75c0abdbdf

SHA1
1fe162d6461405f7bd2c8def91e547cf85b28638

SHA256
32e51accf5a30da12e43b3c7f83867577fcd6fb363d7773a743ab1bbb9653d06

SHA512
c7cbf5bbba6c6b4e5069ea0f5b6343e771cfd86f6a1295d7b9b653465f3068ac0a5c9492a89f38ac81db92879642dbab8943507a72438223690bacb291d8cdbc

Download Submit
memory/3276-130-0x00000000005B0000-0x00000000005BE000-memory.dmp

Filesize
56KB

Download
memory/3276-133-0x0000000000900000-0x000000000090B000-memory.dmp

Filesize
44KB

Download
memory/3276-135-0x00000000005A0000-0x00000000005AB000-memory.dmp

Filesize
44KB

Download
memory/4916-138-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4916-141-0x00000000008F0000-0x00000000008FB000-memory.dmp

Filesize
44KB

Download
memory/5112-143-0x00000273DD130000-0x00000273DD140000-memory.dmp

Filesize
64KB

Download
memory/5112-144-0x00000273DD190000-0x00000273DD1A0000-memory.dmp

Filesize
64KB

Download
memory/5112-145-0x00000273DFE80000-0x00000273DFE84000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads