systembc | 61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a

General

Target

61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a.exe
Size

70KB
MD5

f195e871b1ab880b23404610b2b72020
SHA1

e1098fe407ab6c57d42cb30b31959eb1c9d3eacf
SHA256

61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a
SHA512

1ceb677353244633fe6d0ee7c253e15c8bab140f01cc82374024e58ae48fd46218f3049e636de1830f671b83f4d619f2253ee266a3820662d5c02a371af8737e

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

asdasd08.com:4039

asdasd08.xyz:4039

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

xxll.exe

pid process

1188 xxll.exe
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
6 api.ipify.org
7 ip4.seeip.org
8 ip4.seeip.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
1188	xxll.exe

flow	ioc
5	api.ipify.org
6	api.ipify.org
7	ip4.seeip.org
8	ip4.seeip.org

Drops file in Windows directory 2 IoCs

Processes:

61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a.exe

description	ioc	process
File created	C:\Windows\Tasks\xxll.job	61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a.exe
File opened for modification	C:\Windows\Tasks\xxll.job	61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a.exe

pid process

1668 61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a.exe

pid	process
1668	61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2004 wrote to memory of 1188	2004	taskeng.exe	xxll.exe
PID 2004 wrote to memory of 1188	2004	taskeng.exe	xxll.exe
PID 2004 wrote to memory of 1188	2004	taskeng.exe	xxll.exe
PID 2004 wrote to memory of 1188	2004	taskeng.exe	xxll.exe

C:\Users\Admin\AppData\Local\Temp\61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a.exe
"C:\Users\Admin\AppData\Local\Temp\61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1668

C:\Windows\system32\taskeng.exe
taskeng.exe {2A83C22A-5EA4-4376-B757-DE8C2BA7F5AD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\ProgramData\esmc\xxll.exe
C:\ProgramData\esmc\xxll.exe start
2⤵
- Executes dropped EXE
PID:1188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

1

T1090

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

1

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\esmc\xxll.exe
Filesize
70KB

MD5
f195e871b1ab880b23404610b2b72020

SHA1
e1098fe407ab6c57d42cb30b31959eb1c9d3eacf

SHA256
61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a

SHA512
1ceb677353244633fe6d0ee7c253e15c8bab140f01cc82374024e58ae48fd46218f3049e636de1830f671b83f4d619f2253ee266a3820662d5c02a371af8737e

Download Submit
C:\ProgramData\esmc\xxll.exe
Filesize
70KB

MD5
f195e871b1ab880b23404610b2b72020

SHA1
e1098fe407ab6c57d42cb30b31959eb1c9d3eacf

SHA256
61910440b8efa275a9aeb143b4d0441b4f67900f8710e8464e4dc4795739268a

SHA512
1ceb677353244633fe6d0ee7c253e15c8bab140f01cc82374024e58ae48fd46218f3049e636de1830f671b83f4d619f2253ee266a3820662d5c02a371af8737e

Download Submit
memory/1188-60-0x0000000000000000-mapping.dmp

Download
memory/1188-62-0x000000000066B000-0x0000000000672000-memory.dmp

Filesize
28KB

Download
memory/1188-64-0x000000000066B000-0x0000000000672000-memory.dmp

Filesize
28KB

Download
memory/1188-65-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/1668-54-0x000000000060B000-0x0000000000612000-memory.dmp

Filesize
28KB

Download
memory/1668-55-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1668-57-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1668-56-0x000000000060B000-0x0000000000612000-memory.dmp

Filesize
28KB

Download
memory/1668-58-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing