systembc | 7861180570ecfb48fccc3e1cff748974c64e58c31530aee4f9243af810200cc3

General

Target

1084219642d497a177c7a02c9c31b193.exe
Size

230KB
MD5

1084219642d497a177c7a02c9c31b193
SHA1

d98644be834e7d3d12346956986f40fb6f50cdf9
SHA256

7861180570ecfb48fccc3e1cff748974c64e58c31530aee4f9243af810200cc3
SHA512

a9e47b2fc6c67ce395adf4f74d4eeb0ecd6ebe79062b61625acb95b6ce7fce0f95adb0b10985ade965c61190564c2a2345be119c3c5c4a6bd99e346495dd82bb

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

psgf.exeervn.exeuruxci.exe

pid process

3140 psgf.exe
1328 ervn.exe
2788 uruxci.exe

pid	process
3140	psgf.exe
1328	ervn.exe
2788	uruxci.exe

Drops file in Windows directory 5 IoCs

Processes:

1084219642d497a177c7a02c9c31b193.exepsgf.exeervn.exe

description	ioc	process
File created	C:\Windows\Tasks\psgf.job	1084219642d497a177c7a02c9c31b193.exe
File opened for modification	C:\Windows\Tasks\psgf.job	1084219642d497a177c7a02c9c31b193.exe
File created	C:\Windows\Tasks\srbofuoslcjixrkosmq.job	psgf.exe
File created	C:\Windows\Tasks\uruxci.job	ervn.exe
File opened for modification	C:\Windows\Tasks\uruxci.job	ervn.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4960 2584 WerFault.exe 1084219642d497a177c7a02c9c31b193.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

1084219642d497a177c7a02c9c31b193.exeervn.exe

pid process

2584 1084219642d497a177c7a02c9c31b193.exe
2584 1084219642d497a177c7a02c9c31b193.exe
1328 ervn.exe
1328 ervn.exe

pid	pid_target	process	target process
4960	2584	WerFault.exe	1084219642d497a177c7a02c9c31b193.exe

pid	process
2584	1084219642d497a177c7a02c9c31b193.exe
2584	1084219642d497a177c7a02c9c31b193.exe
1328	ervn.exe
1328	ervn.exe

C:\Users\Admin\AppData\Local\Temp\1084219642d497a177c7a02c9c31b193.exe
"C:\Users\Admin\AppData\Local\Temp\1084219642d497a177c7a02c9c31b193.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 484
2⤵
- Program crash
PID:4960

C:\ProgramData\hnxe\psgf.exe
C:\ProgramData\hnxe\psgf.exe start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2584 -ip 2584
1⤵
PID:5104

C:\Windows\TEMP\ervn.exe
C:\Windows\TEMP\ervn.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1328

C:\ProgramData\oqug\uruxci.exe
C:\ProgramData\oqug\uruxci.exe start
1⤵
- Executes dropped EXE
PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\hnxe\psgf.exe
Filesize
230KB

MD5
1084219642d497a177c7a02c9c31b193

SHA1
d98644be834e7d3d12346956986f40fb6f50cdf9

SHA256
7861180570ecfb48fccc3e1cff748974c64e58c31530aee4f9243af810200cc3

SHA512
a9e47b2fc6c67ce395adf4f74d4eeb0ecd6ebe79062b61625acb95b6ce7fce0f95adb0b10985ade965c61190564c2a2345be119c3c5c4a6bd99e346495dd82bb

Download Submit
C:\ProgramData\hnxe\psgf.exe
Filesize
230KB

MD5
1084219642d497a177c7a02c9c31b193

SHA1
d98644be834e7d3d12346956986f40fb6f50cdf9

SHA256
7861180570ecfb48fccc3e1cff748974c64e58c31530aee4f9243af810200cc3

SHA512
a9e47b2fc6c67ce395adf4f74d4eeb0ecd6ebe79062b61625acb95b6ce7fce0f95adb0b10985ade965c61190564c2a2345be119c3c5c4a6bd99e346495dd82bb

Download Submit
C:\ProgramData\oqug\uruxci.exe
Filesize
272KB

MD5
71ebd9fd8ea9fc4e67e52546cb45b35a

SHA1
4ce5c776e627a8b13c81b99bcf6cb4bcd7f8369a

SHA256
91e432fb78409fd8fbdbc8783b3e53b0352b207c88519c8550d72237785334b6

SHA512
5ad93d5047f68e349306d8361de4fcbc1e3694ee148c08877c5ead40d3814443ea168f715f256365fc6c73ab61aec59bd5329964d2083bf9c0a46d83e89924ff

Download Submit
C:\ProgramData\oqug\uruxci.exe
Filesize
272KB

MD5
71ebd9fd8ea9fc4e67e52546cb45b35a

SHA1
4ce5c776e627a8b13c81b99bcf6cb4bcd7f8369a

SHA256
91e432fb78409fd8fbdbc8783b3e53b0352b207c88519c8550d72237785334b6

SHA512
5ad93d5047f68e349306d8361de4fcbc1e3694ee148c08877c5ead40d3814443ea168f715f256365fc6c73ab61aec59bd5329964d2083bf9c0a46d83e89924ff

Download Submit
C:\Windows\TEMP\ervn.exe
Filesize
272KB

MD5
71ebd9fd8ea9fc4e67e52546cb45b35a

SHA1
4ce5c776e627a8b13c81b99bcf6cb4bcd7f8369a

SHA256
91e432fb78409fd8fbdbc8783b3e53b0352b207c88519c8550d72237785334b6

SHA512
5ad93d5047f68e349306d8361de4fcbc1e3694ee148c08877c5ead40d3814443ea168f715f256365fc6c73ab61aec59bd5329964d2083bf9c0a46d83e89924ff

Download Submit
C:\Windows\Tasks\psgf.job
Filesize
242B

MD5
0098086e5af8b6bc0f096bbb6a70fd44

SHA1
5cf85ccfc418ca3c2042553999734b582fee3d8f

SHA256
60d91df15e56b0982d363398607b9d1accc7478c0390372629fc9c0406a92b4d

SHA512
aef8636d12e08661e12bb51bb286c57b7e7a1cb47c157064ea267a22d99a717ed5a7c543c1c7b7eec58695ec00d4147ac9dab4aabc7baa1fb1eb0b83a904c26d

Download Submit
C:\Windows\Temp\ervn.exe
Filesize
272KB

MD5
71ebd9fd8ea9fc4e67e52546cb45b35a

SHA1
4ce5c776e627a8b13c81b99bcf6cb4bcd7f8369a

SHA256
91e432fb78409fd8fbdbc8783b3e53b0352b207c88519c8550d72237785334b6

SHA512
5ad93d5047f68e349306d8361de4fcbc1e3694ee148c08877c5ead40d3814443ea168f715f256365fc6c73ab61aec59bd5329964d2083bf9c0a46d83e89924ff

Download Submit
memory/1328-148-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1328-147-0x0000000000695000-0x000000000069E000-memory.dmp

Filesize
36KB

Download
memory/1328-145-0x0000000000695000-0x000000000069E000-memory.dmp

Filesize
36KB

Download
memory/2584-134-0x000000000058C000-0x0000000000595000-memory.dmp

Filesize
36KB

Download
memory/2584-135-0x000000000058C000-0x0000000000595000-memory.dmp

Filesize
36KB

Download
memory/2584-137-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2584-136-0x0000000000550000-0x0000000000559000-memory.dmp

Filesize
36KB

Download
memory/2788-151-0x0000000000665000-0x000000000066E000-memory.dmp

Filesize
36KB

Download
memory/2788-152-0x0000000000665000-0x000000000066E000-memory.dmp

Filesize
36KB

Download
memory/2788-153-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3140-142-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3140-141-0x0000000000608000-0x0000000000611000-memory.dmp

Filesize
36KB

Download
memory/3140-140-0x0000000000608000-0x0000000000611000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads