systembc | 5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d

General

Target

5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exe
Size

233KB
MD5

167dcf64985fc4ae7680243c663ae32f
SHA1

fd1d6ff3ef3ffeadb9d7fd42dafc1bb7ac927ed3
SHA256

5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d
SHA512

b5e24e5a8b0d3b18052c458d5a1c303c745da56591a63cdb0ed6ac352e8cc3f4a018d68c7cdcadc8be0010ef3317427c822c3c270bf949b3bcc6cad485d7903d

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

avtvf.exepaeuadh.exebwek.exe

pid process

2368 avtvf.exe
2500 paeuadh.exe
3976 bwek.exe

pid	process
2368	avtvf.exe
2500	paeuadh.exe
3976	bwek.exe

Drops file in Windows directory 5 IoCs

Processes:

paeuadh.exe5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exeavtvf.exe

description	ioc	process
File created	C:\Windows\Tasks\bwek.job	paeuadh.exe
File opened for modification	C:\Windows\Tasks\bwek.job	paeuadh.exe
File created	C:\Windows\Tasks\avtvf.job	5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exe
File opened for modification	C:\Windows\Tasks\avtvf.job	5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exe
File created	C:\Windows\Tasks\pnhmpcgvnrjbrvofvbr.job	avtvf.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1428 3704 WerFault.exe 5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exe

pid	pid_target	process	target process
1428	3704	WerFault.exe	5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exepaeuadh.exe

pid	process
3704	5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exe
3704	5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exe
2500	paeuadh.exe
2500	paeuadh.exe

C:\Users\Admin\AppData\Local\Temp\5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exe
"C:\Users\Admin\AppData\Local\Temp\5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 484
  2⤵
  - Program crash
  PID:1428

C:\ProgramData\hdtctx\avtvf.exe
C:\ProgramData\hdtctx\avtvf.exe start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3704 -ip 3704
1⤵
PID:112

C:\Windows\TEMP\paeuadh.exe
C:\Windows\TEMP\paeuadh.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2500

C:\ProgramData\dglgqw\bwek.exe
C:\ProgramData\dglgqw\bwek.exe start
1⤵
- Executes dropped EXE
PID:3976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\dglgqw\bwek.exe

MD5
167dcf64985fc4ae7680243c663ae32f

SHA1
fd1d6ff3ef3ffeadb9d7fd42dafc1bb7ac927ed3

SHA256
5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d

SHA512
b5e24e5a8b0d3b18052c458d5a1c303c745da56591a63cdb0ed6ac352e8cc3f4a018d68c7cdcadc8be0010ef3317427c822c3c270bf949b3bcc6cad485d7903d

Download Submit
C:\ProgramData\dglgqw\bwek.exe

MD5
167dcf64985fc4ae7680243c663ae32f

SHA1
fd1d6ff3ef3ffeadb9d7fd42dafc1bb7ac927ed3

SHA256
5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d

SHA512
b5e24e5a8b0d3b18052c458d5a1c303c745da56591a63cdb0ed6ac352e8cc3f4a018d68c7cdcadc8be0010ef3317427c822c3c270bf949b3bcc6cad485d7903d

Download Submit
C:\ProgramData\hdtctx\avtvf.exe

MD5
167dcf64985fc4ae7680243c663ae32f

SHA1
fd1d6ff3ef3ffeadb9d7fd42dafc1bb7ac927ed3

SHA256
5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d

SHA512
b5e24e5a8b0d3b18052c458d5a1c303c745da56591a63cdb0ed6ac352e8cc3f4a018d68c7cdcadc8be0010ef3317427c822c3c270bf949b3bcc6cad485d7903d

Download Submit
C:\ProgramData\hdtctx\avtvf.exe

MD5
167dcf64985fc4ae7680243c663ae32f

SHA1
fd1d6ff3ef3ffeadb9d7fd42dafc1bb7ac927ed3

SHA256
5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d

SHA512
b5e24e5a8b0d3b18052c458d5a1c303c745da56591a63cdb0ed6ac352e8cc3f4a018d68c7cdcadc8be0010ef3317427c822c3c270bf949b3bcc6cad485d7903d

Download Submit
C:\Windows\TEMP\paeuadh.exe

MD5
167dcf64985fc4ae7680243c663ae32f

SHA1
fd1d6ff3ef3ffeadb9d7fd42dafc1bb7ac927ed3

SHA256
5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d

SHA512
b5e24e5a8b0d3b18052c458d5a1c303c745da56591a63cdb0ed6ac352e8cc3f4a018d68c7cdcadc8be0010ef3317427c822c3c270bf949b3bcc6cad485d7903d

Download Submit
C:\Windows\Tasks\avtvf.job

MD5
b910dcdcc36691a0c6afbffbcc717f94

SHA1
bbc6daec9c205c6c493fac63f8cd3efd0e411af5

SHA256
c6458a2cca2a78952998a98c11b78f5fa19d1c28993cbff328bce283283c4c6b

SHA512
00b9ad62cf4d7c3874db8370f4e00949280090c1541817b37368a2b63129d22b9240f4849c76a29f758eb60b515c3d7dbc99873c3f068374ee930ac06bc3b658

Download Submit
C:\Windows\Temp\paeuadh.exe

MD5
167dcf64985fc4ae7680243c663ae32f

SHA1
fd1d6ff3ef3ffeadb9d7fd42dafc1bb7ac927ed3

SHA256
5b7c5150d104a4cf436ead6edf494436bd4b003296d3b76f14a8e0904e0d671d

SHA512
b5e24e5a8b0d3b18052c458d5a1c303c745da56591a63cdb0ed6ac352e8cc3f4a018d68c7cdcadc8be0010ef3317427c822c3c270bf949b3bcc6cad485d7903d

Download Submit
memory/2368-142-0x0000000000790000-0x0000000000799000-memory.dmp

Filesize
36KB

Download
memory/2368-143-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2368-140-0x00000000007ED000-0x00000000007F6000-memory.dmp

Filesize
36KB

Download
memory/2368-141-0x00000000007ED000-0x00000000007F6000-memory.dmp

Filesize
36KB

Download
memory/2500-148-0x000000000059D000-0x00000000005A6000-memory.dmp

Filesize
36KB

Download
memory/2500-149-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2500-146-0x000000000059D000-0x00000000005A6000-memory.dmp

Filesize
36KB

Download
memory/3704-137-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3704-134-0x00000000007A0000-0x00000000007A9000-memory.dmp

Filesize
36KB

Download
memory/3704-136-0x0000000000700000-0x0000000000709000-memory.dmp

Filesize
36KB

Download
memory/3704-135-0x00000000007A0000-0x00000000007A9000-memory.dmp

Filesize
36KB

Download
memory/3976-152-0x00000000005CD000-0x00000000005D6000-memory.dmp

Filesize
36KB

Download
memory/3976-153-0x00000000005CD000-0x00000000005D6000-memory.dmp

Filesize
36KB

Download
memory/3976-154-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing