systembc | 3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5

General

Target

3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe
Size

273KB
MD5

db48d4c7abbfe0c4daeba6ae790a193f
SHA1

ee73e2598351f8088cb20d84398e45e7b0092d83
SHA256

3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5
SHA512

dda02e130458496878850278bef01fb4660107acce9cb9d44308713ed960173645c68e5fceab54de1a63fa232061b2d31ddd68fd6daa718379dfb461d5784c5d

Score

10^/10

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata: ET MALWARE Win32/SystemBC CnC Checkin
suricata
Executes dropped EXE 1 IoCs

Processes:

gpxx.exe

pid process

2848 gpxx.exe

pid	process
2848	gpxx.exe

Drops file in Windows directory 2 IoCs

Processes:

3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe

description	ioc	process
File created	C:\Windows\Tasks\gpxx.job	3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe
File opened for modification	C:\Windows\Tasks\gpxx.job	3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3844 868 WerFault.exe 3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe

pid	pid_target	process	target process
3844	868	WerFault.exe	3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe

pid	process
868	3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe
868	3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe

C:\Users\Admin\AppData\Local\Temp\3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe
"C:\Users\Admin\AppData\Local\Temp\3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 932
  2⤵
  - Program crash
  PID:3844

C:\ProgramData\pxmagig\gpxx.exe
C:\ProgramData\pxmagig\gpxx.exe start
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 868 -ip 868
1⤵
PID:648

C:\ProgramData\pxmagig\gpxx.exe

Filesize
273KB

MD5
db48d4c7abbfe0c4daeba6ae790a193f

SHA1
ee73e2598351f8088cb20d84398e45e7b0092d83

SHA256
3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5

SHA512
dda02e130458496878850278bef01fb4660107acce9cb9d44308713ed960173645c68e5fceab54de1a63fa232061b2d31ddd68fd6daa718379dfb461d5784c5d

Download Submit
C:\ProgramData\pxmagig\gpxx.exe

Filesize
273KB

MD5
db48d4c7abbfe0c4daeba6ae790a193f

SHA1
ee73e2598351f8088cb20d84398e45e7b0092d83

SHA256
3c9ef5745181c229512ed61a6cb25882eb485ba295c6bb10c4a3e6aefb6533c5

SHA512
dda02e130458496878850278bef01fb4660107acce9cb9d44308713ed960173645c68e5fceab54de1a63fa232061b2d31ddd68fd6daa718379dfb461d5784c5d

Download Submit
memory/868-130-0x0000000000648000-0x0000000000651000-memory.dmp

Filesize
36KB

Download
memory/868-131-0x0000000000648000-0x0000000000651000-memory.dmp

Filesize
36KB

Download
memory/868-132-0x00000000001F0000-0x00000000001F9000-memory.dmp

Filesize
36KB

Download
memory/868-133-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2848-136-0x0000000000735000-0x000000000073E000-memory.dmp

Filesize
36KB

Download
memory/2848-137-0x0000000000735000-0x000000000073E000-memory.dmp

Filesize
36KB

Download
memory/2848-138-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download