systembc | c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b

General

Target

c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe
Size

129KB
MD5

97df61f72744b694bc0ce16556510b83
SHA1

b6c9484e550f8f4ff3155c5ed8ae4a8e3422018c
SHA256

c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b
SHA512

610a3b2b253d7e34c2091250354d9d08b524d8da3836ca75d96af2562551176a9e85fdb02d6ed6aeb417c84b19c1cdea9a4b9644136f3c4ed3bfb554e5f81486

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

dasd13d.com:4035

dasd13d.xyz:4035

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

dajc.exe

pid process

408 dajc.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

39 api.ipify.org
42 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
408	dajc.exe

flow	ioc
39	api.ipify.org
42	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe

description	ioc	process
File created	C:\Windows\Tasks\dajc.job	c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe
File opened for modification	C:\Windows\Tasks\dajc.job	c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1216 4808 WerFault.exe c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe

pid	pid_target	process	target process
1216	4808	WerFault.exe	c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe

pid	process
4808	c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe
4808	c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe

C:\Users\Admin\AppData\Local\Temp\c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe
"C:\Users\Admin\AppData\Local\Temp\c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 480
2⤵
- Program crash
PID:1216

C:\ProgramData\enwudc\dajc.exe
C:\ProgramData\enwudc\dajc.exe start
1⤵
- Executes dropped EXE
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4808 -ip 4808
1⤵
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

1

T1090

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\enwudc\dajc.exe
Filesize
129KB

MD5
97df61f72744b694bc0ce16556510b83

SHA1
b6c9484e550f8f4ff3155c5ed8ae4a8e3422018c

SHA256
c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b

SHA512
610a3b2b253d7e34c2091250354d9d08b524d8da3836ca75d96af2562551176a9e85fdb02d6ed6aeb417c84b19c1cdea9a4b9644136f3c4ed3bfb554e5f81486

Download Submit
C:\ProgramData\enwudc\dajc.exe
Filesize
129KB

MD5
97df61f72744b694bc0ce16556510b83

SHA1
b6c9484e550f8f4ff3155c5ed8ae4a8e3422018c

SHA256
c6796f4e5a17fb9ce0e1d33b9d767fbed5a4c43e65e2741af09015cb23932d2b

SHA512
610a3b2b253d7e34c2091250354d9d08b524d8da3836ca75d96af2562551176a9e85fdb02d6ed6aeb417c84b19c1cdea9a4b9644136f3c4ed3bfb554e5f81486

Download Submit
memory/408-136-0x0000000000990000-0x0000000000A90000-memory.dmp

Filesize
1024KB

Download
memory/408-137-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/4808-130-0x0000000000AE8000-0x0000000000AEF000-memory.dmp

Filesize
28KB

Download
memory/4808-131-0x0000000000930000-0x0000000000939000-memory.dmp

Filesize
36KB

Download
memory/4808-132-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download

Analysis

Sharing