systembc | 4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3

General

Target

4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe
Size

86KB
MD5

15fc2174c2ae34b7fe7cd171779fecf2
SHA1

91a705af5d47a7e96b04f79c065a2d19fbc7916a
SHA256

4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3
SHA512

b2cc0196feb948c1084f6de526b39ace1b3ff85c0824947bc4f2420a1583967194be5190a7752a872628e089acdd9730dd88188ee08123c0460307a86bfa6ba5

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

advertrex20.xyz:4044

gentexman37.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

hipeia.exe

pid process

4576 hipeia.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

30 api.ipify.org
31 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
4576	hipeia.exe

flow	ioc
30	api.ipify.org
31	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe

description	ioc	process
File created	C:\Windows\Tasks\hipeia.job	4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe
File opened for modification	C:\Windows\Tasks\hipeia.job	4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2396 3100 WerFault.exe 4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe

pid	pid_target	process	target process
2396	3100	WerFault.exe	4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe

pid	process
3100	4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe
3100	4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe

C:\Users\Admin\AppData\Local\Temp\4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe
"C:\Users\Admin\AppData\Local\Temp\4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 952
2⤵
- Program crash
PID:2396

C:\ProgramData\npsrhko\hipeia.exe
C:\ProgramData\npsrhko\hipeia.exe start
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3100 -ip 3100
1⤵
PID:2348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

1

T1090

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

1

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\npsrhko\hipeia.exe
Filesize
86KB

MD5
15fc2174c2ae34b7fe7cd171779fecf2

SHA1
91a705af5d47a7e96b04f79c065a2d19fbc7916a

SHA256
4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3

SHA512
b2cc0196feb948c1084f6de526b39ace1b3ff85c0824947bc4f2420a1583967194be5190a7752a872628e089acdd9730dd88188ee08123c0460307a86bfa6ba5

Download Submit
C:\ProgramData\npsrhko\hipeia.exe
Filesize
86KB

MD5
15fc2174c2ae34b7fe7cd171779fecf2

SHA1
91a705af5d47a7e96b04f79c065a2d19fbc7916a

SHA256
4998be5d75d44d405ec6144f6fbc13083d58dfb38b1d309004ac2c6aa82d13b3

SHA512
b2cc0196feb948c1084f6de526b39ace1b3ff85c0824947bc4f2420a1583967194be5190a7752a872628e089acdd9730dd88188ee08123c0460307a86bfa6ba5

Download Submit
memory/3100-133-0x000000000323D000-0x0000000003244000-memory.dmp

Filesize
28KB

Download
memory/3100-134-0x000000000323D000-0x0000000003244000-memory.dmp

Filesize
28KB

Download
memory/3100-135-0x00000000031F0000-0x00000000031F9000-memory.dmp

Filesize
36KB

Download
memory/3100-136-0x0000000000400000-0x0000000002FA0000-memory.dmp

Filesize
43.6MB

Download
memory/4576-139-0x00000000031D8000-0x00000000031DF000-memory.dmp

Filesize
28KB

Download
memory/4576-140-0x00000000031D8000-0x00000000031DF000-memory.dmp

Filesize
28KB

Download
memory/4576-141-0x0000000000400000-0x0000000002FA0000-memory.dmp

Filesize
43.6MB

Download

Analysis

Sharing