systembc | 142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

General

Target

142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exe
Size

229KB
MD5

66b2d7c88954a2afe07b15d0f6093c25
SHA1

1d0b138eaedea0562284741f3028e3adbf3a2f79
SHA256

142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971
SHA512

45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

piafi.exeibkltnw.exeipqo.exe

pid process

4560 piafi.exe
4276 ibkltnw.exe
4160 ipqo.exe

pid	process
4560	piafi.exe
4276	ibkltnw.exe
4160	ipqo.exe

Drops file in Windows directory 5 IoCs

Processes:

piafi.exeibkltnw.exe142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exe

description	ioc	process
File created	C:\Windows\Tasks\xqdmsqntqwucxfcigmj.job	piafi.exe
File created	C:\Windows\Tasks\ipqo.job	ibkltnw.exe
File opened for modification	C:\Windows\Tasks\ipqo.job	ibkltnw.exe
File created	C:\Windows\Tasks\piafi.job	142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exe
File opened for modification	C:\Windows\Tasks\piafi.job	142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2964 1268 WerFault.exe 142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exe

pid	pid_target	process	target process
2964	1268	WerFault.exe	142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exeibkltnw.exe

pid	process
1268	142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exe
1268	142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exe
4276	ibkltnw.exe
4276	ibkltnw.exe

C:\Users\Admin\AppData\Local\Temp\142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exe
"C:\Users\Admin\AppData\Local\Temp\142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 260
2⤵
- Program crash
PID:2964

C:\ProgramData\rrgsgrg\piafi.exe
C:\ProgramData\rrgsgrg\piafi.exe start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1268 -ip 1268
1⤵
PID:4064

C:\Windows\TEMP\ibkltnw.exe
C:\Windows\TEMP\ibkltnw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4276

C:\ProgramData\nmidx\ipqo.exe
C:\ProgramData\nmidx\ipqo.exe start
1⤵
- Executes dropped EXE
PID:4160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\nmidx\ipqo.exe
MD5
66b2d7c88954a2afe07b15d0f6093c25

SHA1
1d0b138eaedea0562284741f3028e3adbf3a2f79

SHA256
142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

SHA512
45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Download Submit
C:\ProgramData\nmidx\ipqo.exe
MD5
66b2d7c88954a2afe07b15d0f6093c25

SHA1
1d0b138eaedea0562284741f3028e3adbf3a2f79

SHA256
142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

SHA512
45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Download Submit
C:\ProgramData\rrgsgrg\piafi.exe
MD5
66b2d7c88954a2afe07b15d0f6093c25

SHA1
1d0b138eaedea0562284741f3028e3adbf3a2f79

SHA256
142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

SHA512
45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Download Submit
C:\ProgramData\rrgsgrg\piafi.exe
MD5
66b2d7c88954a2afe07b15d0f6093c25

SHA1
1d0b138eaedea0562284741f3028e3adbf3a2f79

SHA256
142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

SHA512
45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Download Submit
C:\Windows\TEMP\ibkltnw.exe
MD5
66b2d7c88954a2afe07b15d0f6093c25

SHA1
1d0b138eaedea0562284741f3028e3adbf3a2f79

SHA256
142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

SHA512
45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Download Submit
C:\Windows\Tasks\piafi.job
MD5
47e8efdbd933cefb495223df90dc9f60

SHA1
11ef1b93044e66a5b9fd74d9e9541c268d1a88db

SHA256
e0c307beb7a0b6e18e29843bd56f7c9e5261ef07b369c8d895d24033c541f066

SHA512
793408d2e56abf297dc30a0de6050555e3bf5eb2d3a419f3268c3fa6d29701989f3b274df182d585db430ca502205cd563d629eb6bbd08cd4e3ec82e0ff1a8c7

Download Submit
C:\Windows\Temp\ibkltnw.exe
MD5
66b2d7c88954a2afe07b15d0f6093c25

SHA1
1d0b138eaedea0562284741f3028e3adbf3a2f79

SHA256
142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

SHA512
45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Download Submit
memory/1268-131-0x00000000007FC000-0x0000000000805000-memory.dmp

Filesize
36KB

Download
memory/1268-130-0x00000000007FC000-0x0000000000805000-memory.dmp

Filesize
36KB

Download
memory/1268-132-0x00000000007D0000-0x00000000007D9000-memory.dmp

Filesize
36KB

Download
memory/1268-133-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4160-147-0x0000000000639000-0x0000000000641000-memory.dmp

Filesize
32KB

Download
memory/4160-148-0x0000000000639000-0x0000000000641000-memory.dmp

Filesize
32KB

Download
memory/4160-149-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4276-141-0x0000000000518000-0x0000000000521000-memory.dmp

Filesize
36KB

Download
memory/4276-143-0x0000000000518000-0x0000000000521000-memory.dmp

Filesize
36KB

Download
memory/4276-144-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4560-138-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4560-137-0x0000000000699000-0x00000000006A1000-memory.dmp

Filesize
32KB

Download
memory/4560-136-0x0000000000699000-0x00000000006A1000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing