systembc | e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76

General

Target

e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe
Size

156KB
MD5

53dea6ee1aeb6e0b102803c43b177967
SHA1

76ae52abaaa31d8f946a1888d33b8cf08f100c8b
SHA256

e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76
SHA512

815dda2786dab4d05cc53084f9a3b04c9d3256b764d6f16bde2ef1ab7b228e08f7ddd3f417c1eacac7f9fab6a4208e7d0c8504083ccc6fa14c71ea102585825e

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

advertrex20.xyz:4044

gentexman37.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

weuan.exe

pid process

5088 weuan.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 api.ipify.org
20 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
5088	weuan.exe

flow	ioc
19	api.ipify.org
20	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe

description	ioc	process
File created	C:\Windows\Tasks\weuan.job	e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe
File opened for modification	C:\Windows\Tasks\weuan.job	e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3036 3040 WerFault.exe e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe

pid	pid_target	process	target process
3036	3040	WerFault.exe	e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe

pid	process
3040	e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe
3040	e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe

C:\Users\Admin\AppData\Local\Temp\e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe
"C:\Users\Admin\AppData\Local\Temp\e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 956
  2⤵
  - Program crash
  PID:3036

C:\ProgramData\uhxdl\weuan.exe
C:\ProgramData\uhxdl\weuan.exe start
1⤵
- Executes dropped EXE
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3040 -ip 3040
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

1

T1090

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

1

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\uhxdl\weuan.exe

Filesize
156KB

MD5
53dea6ee1aeb6e0b102803c43b177967

SHA1
76ae52abaaa31d8f946a1888d33b8cf08f100c8b

SHA256
e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76

SHA512
815dda2786dab4d05cc53084f9a3b04c9d3256b764d6f16bde2ef1ab7b228e08f7ddd3f417c1eacac7f9fab6a4208e7d0c8504083ccc6fa14c71ea102585825e

Download Submit
C:\ProgramData\uhxdl\weuan.exe

Filesize
156KB

MD5
53dea6ee1aeb6e0b102803c43b177967

SHA1
76ae52abaaa31d8f946a1888d33b8cf08f100c8b

SHA256
e9feac3695a81a71ede3b7b768869a336403251fd00333a6ea4d0265f90d2e76

SHA512
815dda2786dab4d05cc53084f9a3b04c9d3256b764d6f16bde2ef1ab7b228e08f7ddd3f417c1eacac7f9fab6a4208e7d0c8504083ccc6fa14c71ea102585825e

Download Submit
memory/3040-130-0x0000000000B08000-0x0000000000B0F000-memory.dmp

Filesize
28KB

Download
memory/3040-131-0x0000000000B08000-0x0000000000B0F000-memory.dmp

Filesize
28KB

Download
memory/3040-132-0x0000000000A10000-0x0000000000A19000-memory.dmp

Filesize
36KB

Download
memory/3040-133-0x0000000000400000-0x00000000008C6000-memory.dmp

Filesize
4.8MB

Download
memory/5088-136-0x0000000000B43000-0x0000000000B49000-memory.dmp

Filesize
24KB

Download
memory/5088-137-0x0000000000B43000-0x0000000000B49000-memory.dmp

Filesize
24KB

Download
memory/5088-138-0x0000000000400000-0x00000000008C6000-memory.dmp

Filesize
4.8MB

Download

Analysis

Sharing