systembc | f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d

General

Target

f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exe
Size

223KB
MD5

a7cbdc69144242409bce8285135b61f8
SHA1

73594de56be8beaf92392af56c8bcc2fa44a6eac
SHA256

f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d
SHA512

8f80815e16cdf899946bef69f7068cd8f8c1877e803bffc31a09195e18720a6149205f0dde7428894a81d09c41969d3e7e58d41b670354ec8095ea8e05c86bf3

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

jltqnp.exervcfk.exe

pid process

4996 jltqnp.exe
4956 rvcfk.exe

pid	process
4996	jltqnp.exe
4956	rvcfk.exe

Drops file in Windows directory 3 IoCs

Processes:

f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exejltqnp.exe

description	ioc	process
File created	C:\Windows\Tasks\jltqnp.job	f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exe
File opened for modification	C:\Windows\Tasks\jltqnp.job	f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exe
File created	C:\Windows\Tasks\hedlbxudjxnlbpvejxn.job	jltqnp.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3112 2820 WerFault.exe f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exe

pid	pid_target	process	target process
3112	2820	WerFault.exe	f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exe

pid	process
2820	f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exe
2820	f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exe

C:\Users\Admin\AppData\Local\Temp\f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exe
"C:\Users\Admin\AppData\Local\Temp\f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 952
2⤵
- Program crash
PID:3112

C:\ProgramData\ecopo\jltqnp.exe
C:\ProgramData\ecopo\jltqnp.exe start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2820 -ip 2820
1⤵
PID:3676

C:\Windows\TEMP\rvcfk.exe
C:\Windows\TEMP\rvcfk.exe
1⤵
- Executes dropped EXE
PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ecopo\jltqnp.exe
MD5
a7cbdc69144242409bce8285135b61f8

SHA1
73594de56be8beaf92392af56c8bcc2fa44a6eac

SHA256
f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d

SHA512
8f80815e16cdf899946bef69f7068cd8f8c1877e803bffc31a09195e18720a6149205f0dde7428894a81d09c41969d3e7e58d41b670354ec8095ea8e05c86bf3

Download Submit
C:\ProgramData\ecopo\jltqnp.exe
MD5
a7cbdc69144242409bce8285135b61f8

SHA1
73594de56be8beaf92392af56c8bcc2fa44a6eac

SHA256
f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d

SHA512
8f80815e16cdf899946bef69f7068cd8f8c1877e803bffc31a09195e18720a6149205f0dde7428894a81d09c41969d3e7e58d41b670354ec8095ea8e05c86bf3

Download Submit
C:\Windows\TEMP\rvcfk.exe
MD5
a7cbdc69144242409bce8285135b61f8

SHA1
73594de56be8beaf92392af56c8bcc2fa44a6eac

SHA256
f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d

SHA512
8f80815e16cdf899946bef69f7068cd8f8c1877e803bffc31a09195e18720a6149205f0dde7428894a81d09c41969d3e7e58d41b670354ec8095ea8e05c86bf3

Download Submit
C:\Windows\Tasks\jltqnp.job
MD5
ada5795231ac12c5a5baabe2aea6a00b

SHA1
22613d852da24a0ad4891790cb20303b3688ab88

SHA256
0b8007727e2c7cda65ff39072665c4428b26cf84531b75d3de991ea7599beab3

SHA512
c4e5dd05a5ae55558d892a5b83111d095065342bc740d6a7d1de8290ab88fc63484a62770eb29bfe7853dfb6661b05d07b8a248c5491a060b5aabc8d76d47478

Download Submit
C:\Windows\Temp\rvcfk.exe
MD5
a7cbdc69144242409bce8285135b61f8

SHA1
73594de56be8beaf92392af56c8bcc2fa44a6eac

SHA256
f891e10c9a7b6d0cbbbb6b3d103cf3dc935541430c5363648e6e1a3203bdd76d

SHA512
8f80815e16cdf899946bef69f7068cd8f8c1877e803bffc31a09195e18720a6149205f0dde7428894a81d09c41969d3e7e58d41b670354ec8095ea8e05c86bf3

Download Submit
memory/2820-133-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2820-130-0x00000000004E8000-0x00000000004F1000-memory.dmp

Filesize
36KB

Download
memory/2820-132-0x00000000004C0000-0x00000000004C9000-memory.dmp

Filesize
36KB

Download
memory/2820-131-0x00000000004E8000-0x00000000004F1000-memory.dmp

Filesize
36KB

Download
memory/4956-141-0x00000000006D5000-0x00000000006DE000-memory.dmp

Filesize
36KB

Download
memory/4956-143-0x00000000006D5000-0x00000000006DE000-memory.dmp

Filesize
36KB

Download
memory/4956-144-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4996-136-0x00000000004A5000-0x00000000004AE000-memory.dmp

Filesize
36KB

Download
memory/4996-137-0x00000000004A5000-0x00000000004AE000-memory.dmp

Filesize
36KB

Download
memory/4996-138-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing