systembc | b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152

General

Target

b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152.exe
Size

98KB
MD5

b0a7c828e9567926e1e6f7d846472d4e
SHA1

350ef211ce98cebdd6ac0a2260a53c16197d65fb
SHA256

b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152
SHA512

326bc5717f4fe6767a0708b31ca68eb8dd87309ead3693707b803581f8d743705195f5ffd7b006d5b6ad5f84d60bac48f889c1d85578e0dd9947e6ab28a7bf77

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

advertrex20.xyz:4044

gentexman37.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata
Executes dropped EXE 1 IoCs

Processes:

tckjlwn.exe

pid process

4416 tckjlwn.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 api.ipify.org
21 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
4416	tckjlwn.exe

flow	ioc
20	api.ipify.org
21	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152.exe

description	ioc	process
File created	C:\Windows\Tasks\tckjlwn.job	b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152.exe
File opened for modification	C:\Windows\Tasks\tckjlwn.job	b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152.exe

pid	process
4720	b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152.exe
4720	b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152.exe

C:\Users\Admin\AppData\Local\Temp\b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152.exe
"C:\Users\Admin\AppData\Local\Temp\b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4720

C:\ProgramData\wfogmd\tckjlwn.exe
C:\ProgramData\wfogmd\tckjlwn.exe start
1⤵
- Executes dropped EXE
PID:4416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

1

T1090

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

1

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\wfogmd\tckjlwn.exe

Filesize
98KB

MD5
b0a7c828e9567926e1e6f7d846472d4e

SHA1
350ef211ce98cebdd6ac0a2260a53c16197d65fb

SHA256
b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152

SHA512
326bc5717f4fe6767a0708b31ca68eb8dd87309ead3693707b803581f8d743705195f5ffd7b006d5b6ad5f84d60bac48f889c1d85578e0dd9947e6ab28a7bf77

Download Submit
C:\ProgramData\wfogmd\tckjlwn.exe

Filesize
98KB

MD5
b0a7c828e9567926e1e6f7d846472d4e

SHA1
350ef211ce98cebdd6ac0a2260a53c16197d65fb

SHA256
b7a122f6adabcddb7744f3a31e593f5f4ad80e0d433eee8b6d61c13e86731152

SHA512
326bc5717f4fe6767a0708b31ca68eb8dd87309ead3693707b803581f8d743705195f5ffd7b006d5b6ad5f84d60bac48f889c1d85578e0dd9947e6ab28a7bf77

Download Submit
memory/4416-136-0x0000000002FE8000-0x0000000002FEF000-memory.dmp

Filesize
28KB

Download
memory/4416-137-0x0000000002FE8000-0x0000000002FEF000-memory.dmp

Filesize
28KB

Download
memory/4416-138-0x0000000000400000-0x0000000002FA3000-memory.dmp

Filesize
43.6MB

Download
memory/4720-130-0x00000000030ED000-0x00000000030F4000-memory.dmp

Filesize
28KB

Download
memory/4720-131-0x00000000030ED000-0x00000000030F4000-memory.dmp

Filesize
28KB

Download
memory/4720-132-0x00000000030C0000-0x00000000030C9000-memory.dmp

Filesize
36KB

Download
memory/4720-133-0x0000000000400000-0x0000000002FA3000-memory.dmp

Filesize
43.6MB

Download

Analysis

Sharing