systembc | 4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a

General

Target

4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a.exe
Size

327KB
MD5

64dc2deee414ac3f693334939178fa9a
SHA1

93831ff8a611920cb8608c8f9ca4179aa44cf2f0
SHA256

4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a
SHA512

0bc3873ddbab75e1f9eda4b2b1a9170818e98db2f9fb90ac48795b124fcbd5b1c1afbeacbde2e283f8e1d0caf8d8dfb5e94f93c3c2ebe2ddfea6a73c4c2410fd

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

advertrex20.xyz:4044

gentexman37.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata
Executes dropped EXE 1 IoCs

Processes:

ordudm.exe

pid process

1304 ordudm.exe
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
6 api.ipify.org
7 ip4.seeip.org
8 ip4.seeip.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
1304	ordudm.exe

flow	ioc
5	api.ipify.org
6	api.ipify.org
7	ip4.seeip.org
8	ip4.seeip.org

Drops file in Windows directory 2 IoCs

Processes:

4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a.exe

description	ioc	process
File created	C:\Windows\Tasks\ordudm.job	4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a.exe
File opened for modification	C:\Windows\Tasks\ordudm.job	4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a.exe

pid process

1644 4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a.exe

pid	process
1644	4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1740 wrote to memory of 1304	1740	taskeng.exe	ordudm.exe
PID 1740 wrote to memory of 1304	1740	taskeng.exe	ordudm.exe
PID 1740 wrote to memory of 1304	1740	taskeng.exe	ordudm.exe
PID 1740 wrote to memory of 1304	1740	taskeng.exe	ordudm.exe

C:\Users\Admin\AppData\Local\Temp\4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a.exe
"C:\Users\Admin\AppData\Local\Temp\4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1644

C:\Windows\system32\taskeng.exe
taskeng.exe {E56E2DFD-8C68-4DC6-9BB0-DBDC8F44F11A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\ProgramData\twieic\ordudm.exe
  C:\ProgramData\twieic\ordudm.exe start
  2⤵
  - Executes dropped EXE
  PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

1

T1090

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

1

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\twieic\ordudm.exe

Filesize
327KB

MD5
64dc2deee414ac3f693334939178fa9a

SHA1
93831ff8a611920cb8608c8f9ca4179aa44cf2f0

SHA256
4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a

SHA512
0bc3873ddbab75e1f9eda4b2b1a9170818e98db2f9fb90ac48795b124fcbd5b1c1afbeacbde2e283f8e1d0caf8d8dfb5e94f93c3c2ebe2ddfea6a73c4c2410fd

Download Submit
C:\ProgramData\twieic\ordudm.exe

Filesize
327KB

MD5
64dc2deee414ac3f693334939178fa9a

SHA1
93831ff8a611920cb8608c8f9ca4179aa44cf2f0

SHA256
4d44aad03c91a1249a8a83db567467a803a2228542592230d72e39e1dd06628a

SHA512
0bc3873ddbab75e1f9eda4b2b1a9170818e98db2f9fb90ac48795b124fcbd5b1c1afbeacbde2e283f8e1d0caf8d8dfb5e94f93c3c2ebe2ddfea6a73c4c2410fd

Download Submit
memory/1304-59-0x0000000000000000-mapping.dmp

Download
memory/1304-62-0x0000000000400000-0x00000000046CF000-memory.dmp

Filesize
66.8MB

Download
memory/1644-54-0x0000000075901000-0x0000000075903000-memory.dmp

Filesize
8KB

Download
memory/1644-56-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/1644-55-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/1644-57-0x0000000000400000-0x00000000046CF000-memory.dmp

Filesize
66.8MB

Download

Analysis

Sharing