systembc | 142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

General

Target

66b2d7c88954a2afe07b15d0f6093c25.exe
Size

229KB
MD5

66b2d7c88954a2afe07b15d0f6093c25
SHA1

1d0b138eaedea0562284741f3028e3adbf3a2f79
SHA256

142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971
SHA512

45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

fxibnbi.exewhxf.exekuinmiu.exe

pid process

1808 fxibnbi.exe
1560 whxf.exe
540 kuinmiu.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
6 api.ipify.org
7 api.ipify.org

pid	process
1808	fxibnbi.exe
1560	whxf.exe
540	kuinmiu.exe

flow	ioc
5	api.ipify.org
6	api.ipify.org
7	api.ipify.org

Drops file in Windows directory 5 IoCs

Processes:

66b2d7c88954a2afe07b15d0f6093c25.exefxibnbi.exewhxf.exe

description	ioc	process
File created	C:\Windows\Tasks\fxibnbi.job	66b2d7c88954a2afe07b15d0f6093c25.exe
File opened for modification	C:\Windows\Tasks\fxibnbi.job	66b2d7c88954a2afe07b15d0f6093c25.exe
File created	C:\Windows\Tasks\lpjffbbvvrsnojkfgbp.job	fxibnbi.exe
File created	C:\Windows\Tasks\kuinmiu.job	whxf.exe
File opened for modification	C:\Windows\Tasks\kuinmiu.job	whxf.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

66b2d7c88954a2afe07b15d0f6093c25.exewhxf.exe

pid process

1888 66b2d7c88954a2afe07b15d0f6093c25.exe
1560 whxf.exe

pid	process
1888	66b2d7c88954a2afe07b15d0f6093c25.exe
1560	whxf.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1960 wrote to memory of 1808	1960	taskeng.exe	fxibnbi.exe
PID 1960 wrote to memory of 1808	1960	taskeng.exe	fxibnbi.exe
PID 1960 wrote to memory of 1808	1960	taskeng.exe	fxibnbi.exe
PID 1960 wrote to memory of 1808	1960	taskeng.exe	fxibnbi.exe
PID 1960 wrote to memory of 1560	1960	taskeng.exe	whxf.exe
PID 1960 wrote to memory of 1560	1960	taskeng.exe	whxf.exe
PID 1960 wrote to memory of 1560	1960	taskeng.exe	whxf.exe
PID 1960 wrote to memory of 1560	1960	taskeng.exe	whxf.exe
PID 1960 wrote to memory of 540	1960	taskeng.exe	kuinmiu.exe
PID 1960 wrote to memory of 540	1960	taskeng.exe	kuinmiu.exe
PID 1960 wrote to memory of 540	1960	taskeng.exe	kuinmiu.exe
PID 1960 wrote to memory of 540	1960	taskeng.exe	kuinmiu.exe

C:\Users\Admin\AppData\Local\Temp\66b2d7c88954a2afe07b15d0f6093c25.exe
"C:\Users\Admin\AppData\Local\Temp\66b2d7c88954a2afe07b15d0f6093c25.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1888

C:\Windows\system32\taskeng.exe
taskeng.exe {FB594737-0699-4B10-9788-A1700AF23790} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\ProgramData\gcspdqi\fxibnbi.exe
C:\ProgramData\gcspdqi\fxibnbi.exe start
2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1808

C:\Windows\TEMP\whxf.exe
C:\Windows\TEMP\whxf.exe
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1560

C:\ProgramData\wjeobn\kuinmiu.exe
C:\ProgramData\wjeobn\kuinmiu.exe start
2⤵
- Executes dropped EXE
PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\gcspdqi\fxibnbi.exe
Filesize
229KB

MD5
66b2d7c88954a2afe07b15d0f6093c25

SHA1
1d0b138eaedea0562284741f3028e3adbf3a2f79

SHA256
142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

SHA512
45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Download Submit
C:\ProgramData\gcspdqi\fxibnbi.exe
Filesize
229KB

MD5
66b2d7c88954a2afe07b15d0f6093c25

SHA1
1d0b138eaedea0562284741f3028e3adbf3a2f79

SHA256
142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

SHA512
45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Download Submit
C:\ProgramData\wjeobn\kuinmiu.exe
Filesize
272KB

MD5
71ebd9fd8ea9fc4e67e52546cb45b35a

SHA1
4ce5c776e627a8b13c81b99bcf6cb4bcd7f8369a

SHA256
91e432fb78409fd8fbdbc8783b3e53b0352b207c88519c8550d72237785334b6

SHA512
5ad93d5047f68e349306d8361de4fcbc1e3694ee148c08877c5ead40d3814443ea168f715f256365fc6c73ab61aec59bd5329964d2083bf9c0a46d83e89924ff

Download Submit
C:\ProgramData\wjeobn\kuinmiu.exe
Filesize
272KB

MD5
71ebd9fd8ea9fc4e67e52546cb45b35a

SHA1
4ce5c776e627a8b13c81b99bcf6cb4bcd7f8369a

SHA256
91e432fb78409fd8fbdbc8783b3e53b0352b207c88519c8550d72237785334b6

SHA512
5ad93d5047f68e349306d8361de4fcbc1e3694ee148c08877c5ead40d3814443ea168f715f256365fc6c73ab61aec59bd5329964d2083bf9c0a46d83e89924ff

Download Submit
C:\Windows\TEMP\whxf.exe
Filesize
272KB

MD5
71ebd9fd8ea9fc4e67e52546cb45b35a

SHA1
4ce5c776e627a8b13c81b99bcf6cb4bcd7f8369a

SHA256
91e432fb78409fd8fbdbc8783b3e53b0352b207c88519c8550d72237785334b6

SHA512
5ad93d5047f68e349306d8361de4fcbc1e3694ee148c08877c5ead40d3814443ea168f715f256365fc6c73ab61aec59bd5329964d2083bf9c0a46d83e89924ff

Download Submit
C:\Windows\Tasks\fxibnbi.job
Filesize
236B

MD5
ee861483ee07f4aeb1243d712b1f6529

SHA1
3b6b92dcebfd1c515b7e75ce4fbbf87cb8498b88

SHA256
1851fed54151295507da5efc7ac38a8bdc6ad989c42ecb5b7b5f5550243caef9

SHA512
8d9509649798dec850546afcc14b835bdb46a6209393abf53abae988b37d0afe65b1503a95f59584d6dbfb91904be77411ea37639e1754e73904fba5cd643b74

Download Submit
C:\Windows\Temp\whxf.exe
Filesize
272KB

MD5
71ebd9fd8ea9fc4e67e52546cb45b35a

SHA1
4ce5c776e627a8b13c81b99bcf6cb4bcd7f8369a

SHA256
91e432fb78409fd8fbdbc8783b3e53b0352b207c88519c8550d72237785334b6

SHA512
5ad93d5047f68e349306d8361de4fcbc1e3694ee148c08877c5ead40d3814443ea168f715f256365fc6c73ab61aec59bd5329964d2083bf9c0a46d83e89924ff

Download Submit
memory/540-80-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/540-79-0x000000000090E000-0x0000000000916000-memory.dmp

Filesize
32KB

Download
memory/540-77-0x000000000090E000-0x0000000000916000-memory.dmp

Filesize
32KB

Download
memory/540-75-0x0000000000000000-mapping.dmp

Download
memory/1560-67-0x0000000000000000-mapping.dmp

Download
memory/1560-69-0x000000000057E000-0x0000000000586000-memory.dmp

Filesize
32KB

Download
memory/1560-72-0x000000000057E000-0x0000000000586000-memory.dmp

Filesize
32KB

Download
memory/1560-73-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1808-65-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1808-64-0x000000000066E000-0x0000000000676000-memory.dmp

Filesize
32KB

Download
memory/1808-62-0x000000000066E000-0x0000000000676000-memory.dmp

Filesize
32KB

Download
memory/1808-60-0x0000000000000000-mapping.dmp

Download
memory/1888-54-0x000000000059E000-0x00000000005A6000-memory.dmp

Filesize
32KB

Download
memory/1888-58-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1888-57-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1888-56-0x000000000059E000-0x00000000005A6000-memory.dmp

Filesize
32KB

Download
memory/1888-55-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing