systembc | e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

General

Target

e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exe
Size

233KB
MD5

3530e329fdce8e9c8aae9581f050ffdb
SHA1

a076de97dfa81e06c9c3beef8f09d4803249528c
SHA256

e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb
SHA512

77a1ed7abe3c22b36db7cc35f301404362076c556bab06f891279c1c4ee756e4fdc3ed3d03d284af8055dd7c52f93fec291eab74e650cf1d8c5670ef737b82d1

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

kfkugp.exelgvsur.exebtjcfq.exe

pid process

1400 kfkugp.exe
4860 lgvsur.exe
4852 btjcfq.exe

pid	process
1400	kfkugp.exe
4860	lgvsur.exe
4852	btjcfq.exe

Drops file in Windows directory 5 IoCs

Processes:

lgvsur.exee9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exekfkugp.exe

description	ioc	process
File created	C:\Windows\Tasks\btjcfq.job	lgvsur.exe
File opened for modification	C:\Windows\Tasks\btjcfq.job	lgvsur.exe
File created	C:\Windows\Tasks\kfkugp.job	e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exe
File opened for modification	C:\Windows\Tasks\kfkugp.job	e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exe
File created	C:\Windows\Tasks\egecvupojjdswvqpkje.job	kfkugp.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3648 2772 WerFault.exe e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exe

pid	pid_target	process	target process
3648	2772	WerFault.exe	e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exelgvsur.exe

pid	process
2772	e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exe
2772	e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exe
4860	lgvsur.exe
4860	lgvsur.exe

C:\Users\Admin\AppData\Local\Temp\e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exe
"C:\Users\Admin\AppData\Local\Temp\e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 488
2⤵
- Program crash
PID:3648

C:\ProgramData\gobcxtl\kfkugp.exe
C:\ProgramData\gobcxtl\kfkugp.exe start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2772 -ip 2772
1⤵
PID:692

C:\Windows\TEMP\lgvsur.exe
C:\Windows\TEMP\lgvsur.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4860

C:\ProgramData\xgnjkjh\btjcfq.exe
C:\ProgramData\xgnjkjh\btjcfq.exe start
1⤵
- Executes dropped EXE
PID:4852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\gobcxtl\kfkugp.exe
MD5
3530e329fdce8e9c8aae9581f050ffdb

SHA1
a076de97dfa81e06c9c3beef8f09d4803249528c

SHA256
e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

SHA512
77a1ed7abe3c22b36db7cc35f301404362076c556bab06f891279c1c4ee756e4fdc3ed3d03d284af8055dd7c52f93fec291eab74e650cf1d8c5670ef737b82d1

Download Submit
C:\ProgramData\gobcxtl\kfkugp.exe
MD5
3530e329fdce8e9c8aae9581f050ffdb

SHA1
a076de97dfa81e06c9c3beef8f09d4803249528c

SHA256
e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

SHA512
77a1ed7abe3c22b36db7cc35f301404362076c556bab06f891279c1c4ee756e4fdc3ed3d03d284af8055dd7c52f93fec291eab74e650cf1d8c5670ef737b82d1

Download Submit
C:\ProgramData\xgnjkjh\btjcfq.exe
MD5
3530e329fdce8e9c8aae9581f050ffdb

SHA1
a076de97dfa81e06c9c3beef8f09d4803249528c

SHA256
e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

SHA512
77a1ed7abe3c22b36db7cc35f301404362076c556bab06f891279c1c4ee756e4fdc3ed3d03d284af8055dd7c52f93fec291eab74e650cf1d8c5670ef737b82d1

Download Submit
C:\ProgramData\xgnjkjh\btjcfq.exe
MD5
3530e329fdce8e9c8aae9581f050ffdb

SHA1
a076de97dfa81e06c9c3beef8f09d4803249528c

SHA256
e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

SHA512
77a1ed7abe3c22b36db7cc35f301404362076c556bab06f891279c1c4ee756e4fdc3ed3d03d284af8055dd7c52f93fec291eab74e650cf1d8c5670ef737b82d1

Download Submit
C:\Windows\TEMP\lgvsur.exe
MD5
3530e329fdce8e9c8aae9581f050ffdb

SHA1
a076de97dfa81e06c9c3beef8f09d4803249528c

SHA256
e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

SHA512
77a1ed7abe3c22b36db7cc35f301404362076c556bab06f891279c1c4ee756e4fdc3ed3d03d284af8055dd7c52f93fec291eab74e650cf1d8c5670ef737b82d1

Download Submit
C:\Windows\Tasks\kfkugp.job
MD5
c8e1b87db8b3f6efce32ac599b1b7701

SHA1
6dbd169e6288f05423c7e04541b1d8d9cbcdf879

SHA256
a3eeb37cce4db0e91c093c60784ad487fede840a621aeb4fe9a87ebdbc9c2058

SHA512
e2e2013642b961207bace474a0195f7fb782f8b3607dc0a3894cc6a5bcfbc9d3c280157de32610944eba4d6b948766cca219d4b352eb357430a68e4cf12e296a

Download Submit
C:\Windows\Temp\lgvsur.exe
MD5
3530e329fdce8e9c8aae9581f050ffdb

SHA1
a076de97dfa81e06c9c3beef8f09d4803249528c

SHA256
e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

SHA512
77a1ed7abe3c22b36db7cc35f301404362076c556bab06f891279c1c4ee756e4fdc3ed3d03d284af8055dd7c52f93fec291eab74e650cf1d8c5670ef737b82d1

Download Submit
memory/1400-136-0x00000000004BD000-0x00000000004C6000-memory.dmp

Filesize
36KB

Download
memory/1400-137-0x00000000004BD000-0x00000000004C6000-memory.dmp

Filesize
36KB

Download
memory/1400-138-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2772-130-0x0000000000641000-0x000000000064A000-memory.dmp

Filesize
36KB

Download
memory/2772-131-0x0000000000641000-0x000000000064A000-memory.dmp

Filesize
36KB

Download
memory/2772-133-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2772-132-0x0000000000600000-0x0000000000609000-memory.dmp

Filesize
36KB

Download
memory/4852-147-0x000000000075D000-0x0000000000766000-memory.dmp

Filesize
36KB

Download
memory/4852-148-0x000000000075D000-0x0000000000766000-memory.dmp

Filesize
36KB

Download
memory/4852-149-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4860-141-0x000000000073D000-0x0000000000746000-memory.dmp

Filesize
36KB

Download
memory/4860-142-0x000000000073D000-0x0000000000746000-memory.dmp

Filesize
36KB

Download
memory/4860-143-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing