systembc | 351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b

General

Target

351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.exe
Size

237KB
MD5

9c7d736b9a05b483daacdfde24877592
SHA1

66883eedf9301b4a28306cb7a6ca8e731c7e8084
SHA256

351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b
SHA512

dcb99c3d8da8aeeba3617a7a1bb3fb00998538cc8a24a3046c520be93e8703f3a233fc5b7aa41535c97db70cd1333f3ca560c5e2b6577c7032b011860a8f888c

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

cnurkhv.exegfpth.exefbpkkrs.exe

pid process

2376 cnurkhv.exe
2248 gfpth.exe
4444 fbpkkrs.exe

pid	process
2376	cnurkhv.exe
2248	gfpth.exe
4444	fbpkkrs.exe

Drops file in Windows directory 5 IoCs

Processes:

351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.execnurkhv.exegfpth.exe

description	ioc	process
File created	C:\Windows\Tasks\cnurkhv.job	351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.exe
File opened for modification	C:\Windows\Tasks\cnurkhv.job	351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.exe
File created	C:\Windows\Tasks\oatpmigbrsqljecvnom.job	cnurkhv.exe
File created	C:\Windows\Tasks\fbpkkrs.job	gfpth.exe
File opened for modification	C:\Windows\Tasks\fbpkkrs.job	gfpth.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1516 1852 WerFault.exe 351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.exe

pid	pid_target	process	target process
1516	1852	WerFault.exe	351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.exegfpth.exe

pid	process
1852	351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.exe
1852	351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.exe
2248	gfpth.exe
2248	gfpth.exe

C:\Users\Admin\AppData\Local\Temp\351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.exe
"C:\Users\Admin\AppData\Local\Temp\351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 488
2⤵
- Program crash
PID:1516

C:\ProgramData\ocpjaj\cnurkhv.exe
C:\ProgramData\ocpjaj\cnurkhv.exe start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1852 -ip 1852
1⤵
PID:2432

C:\Windows\TEMP\gfpth.exe
C:\Windows\TEMP\gfpth.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2248

C:\ProgramData\nadfvx\fbpkkrs.exe
C:\ProgramData\nadfvx\fbpkkrs.exe start
1⤵
- Executes dropped EXE
PID:4444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\nadfvx\fbpkkrs.exe
MD5
9c7d736b9a05b483daacdfde24877592

SHA1
66883eedf9301b4a28306cb7a6ca8e731c7e8084

SHA256
351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b

SHA512
dcb99c3d8da8aeeba3617a7a1bb3fb00998538cc8a24a3046c520be93e8703f3a233fc5b7aa41535c97db70cd1333f3ca560c5e2b6577c7032b011860a8f888c

Download Submit
C:\ProgramData\nadfvx\fbpkkrs.exe
MD5
9c7d736b9a05b483daacdfde24877592

SHA1
66883eedf9301b4a28306cb7a6ca8e731c7e8084

SHA256
351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b

SHA512
dcb99c3d8da8aeeba3617a7a1bb3fb00998538cc8a24a3046c520be93e8703f3a233fc5b7aa41535c97db70cd1333f3ca560c5e2b6577c7032b011860a8f888c

Download Submit
C:\ProgramData\ocpjaj\cnurkhv.exe
MD5
9c7d736b9a05b483daacdfde24877592

SHA1
66883eedf9301b4a28306cb7a6ca8e731c7e8084

SHA256
351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b

SHA512
dcb99c3d8da8aeeba3617a7a1bb3fb00998538cc8a24a3046c520be93e8703f3a233fc5b7aa41535c97db70cd1333f3ca560c5e2b6577c7032b011860a8f888c

Download Submit
C:\ProgramData\ocpjaj\cnurkhv.exe
MD5
9c7d736b9a05b483daacdfde24877592

SHA1
66883eedf9301b4a28306cb7a6ca8e731c7e8084

SHA256
351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b

SHA512
dcb99c3d8da8aeeba3617a7a1bb3fb00998538cc8a24a3046c520be93e8703f3a233fc5b7aa41535c97db70cd1333f3ca560c5e2b6577c7032b011860a8f888c

Download Submit
C:\Windows\TEMP\gfpth.exe
MD5
9c7d736b9a05b483daacdfde24877592

SHA1
66883eedf9301b4a28306cb7a6ca8e731c7e8084

SHA256
351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b

SHA512
dcb99c3d8da8aeeba3617a7a1bb3fb00998538cc8a24a3046c520be93e8703f3a233fc5b7aa41535c97db70cd1333f3ca560c5e2b6577c7032b011860a8f888c

Download Submit
C:\Windows\Tasks\cnurkhv.job
MD5
24d2431dee991fab3242c0d0401cb659

SHA1
99dd51f3143d891d506d21db89dfb44ccebd372a

SHA256
5a518fb64e2ae0447c2dde29982d3980f5907d9054196523a9b24ff5952b509b

SHA512
10cf63937590d2c9c09878254a8a926762d4cbd7a3d81d4fe77a01cf713fb27e284e81836fa87b3c471fa4f05385faa9c74443f1edfb6e434a516dc138595c7c

Download Submit
C:\Windows\Temp\gfpth.exe
MD5
9c7d736b9a05b483daacdfde24877592

SHA1
66883eedf9301b4a28306cb7a6ca8e731c7e8084

SHA256
351d95304ba12a592fe2dd91f5ea645dd4716400e4def5f6878a24b99770e71b

SHA512
dcb99c3d8da8aeeba3617a7a1bb3fb00998538cc8a24a3046c520be93e8703f3a233fc5b7aa41535c97db70cd1333f3ca560c5e2b6577c7032b011860a8f888c

Download Submit
memory/1852-130-0x0000000000521000-0x000000000052A000-memory.dmp

Filesize
36KB

Download
memory/1852-133-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1852-132-0x0000000000620000-0x0000000000629000-memory.dmp

Filesize
36KB

Download
memory/1852-131-0x0000000000521000-0x000000000052A000-memory.dmp

Filesize
36KB

Download
memory/2248-141-0x00000000006AD000-0x00000000006B6000-memory.dmp

Filesize
36KB

Download
memory/2248-143-0x00000000006AD000-0x00000000006B6000-memory.dmp

Filesize
36KB

Download
memory/2248-144-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2376-138-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2376-137-0x000000000076E000-0x0000000000777000-memory.dmp

Filesize
36KB

Download
memory/2376-136-0x000000000076E000-0x0000000000777000-memory.dmp

Filesize
36KB

Download
memory/4444-148-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/4444-149-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing