systembc | 8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76

General

Target

8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76.exe
Size

138KB
MD5

6349f47feb74e0574f263830bd2de0ee
SHA1

dd9177300210b0647306b31329b2f760dc6e0c21
SHA256

8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76
SHA512

263aa7df76c5ea71d5716059e01e89e90b4deafb0937f9a84570b90d79c4929b6cca72c4c498494d03d98c01b11510ef7630f377226c1003cf8e9c81b574d026

Score

10^/10

systembc trojan upx

Malware Config

Extracted

Family

systembc

C2

admex175x.xyz:4044

servx278x.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

wjeik.exe

pid process

1784 wjeik.exe

pid	process
1784	wjeik.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\ProgramData\npcisc\wjeik.exe	upx
C:\ProgramData\npcisc\wjeik.exe	upx

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip4.seeip.org
5 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

flow	ioc
7	ip4.seeip.org
5	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76.exe

description	ioc	process
File created	C:\Windows\Tasks\wjeik.job	8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76.exe
File opened for modification	C:\Windows\Tasks\wjeik.job	8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76.exe

pid process

316 8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76.exe

pid	process
316	8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 892 wrote to memory of 1784	892	taskeng.exe	wjeik.exe
PID 892 wrote to memory of 1784	892	taskeng.exe	wjeik.exe
PID 892 wrote to memory of 1784	892	taskeng.exe	wjeik.exe
PID 892 wrote to memory of 1784	892	taskeng.exe	wjeik.exe

C:\Users\Admin\AppData\Local\Temp\8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76.exe
"C:\Users\Admin\AppData\Local\Temp\8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:316

C:\Windows\system32\taskeng.exe
taskeng.exe {1A39404E-E835-4B3F-AD2A-29422163EDD5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\ProgramData\npcisc\wjeik.exe
C:\ProgramData\npcisc\wjeik.exe start
2⤵
- Executes dropped EXE
PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

1

T1090

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\npcisc\wjeik.exe
Filesize
138KB

MD5
6349f47feb74e0574f263830bd2de0ee

SHA1
dd9177300210b0647306b31329b2f760dc6e0c21

SHA256
8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76

SHA512
263aa7df76c5ea71d5716059e01e89e90b4deafb0937f9a84570b90d79c4929b6cca72c4c498494d03d98c01b11510ef7630f377226c1003cf8e9c81b574d026

Download Submit
C:\ProgramData\npcisc\wjeik.exe
Filesize
138KB

MD5
6349f47feb74e0574f263830bd2de0ee

SHA1
dd9177300210b0647306b31329b2f760dc6e0c21

SHA256
8684ded985154dee21b01d6ffe6d8a0ded49fcaa3dcd23937374310d7cae6d76

SHA512
263aa7df76c5ea71d5716059e01e89e90b4deafb0937f9a84570b90d79c4929b6cca72c4c498494d03d98c01b11510ef7630f377226c1003cf8e9c81b574d026

Download Submit
memory/316-54-0x00000000769D1000-0x00000000769D3000-memory.dmp

Filesize
8KB

Download
memory/316-55-0x0000000004F1A000-0x0000000004F20000-memory.dmp

Filesize
24KB

Download
memory/316-56-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/316-57-0x0000000000400000-0x0000000004D7C000-memory.dmp

Filesize
73.5MB

Download
memory/1784-59-0x0000000000000000-mapping.dmp

Download
memory/1784-62-0x0000000004EAA000-0x0000000004EB0000-memory.dmp

Filesize
24KB

Download
memory/1784-63-0x0000000000400000-0x0000000004D7C000-memory.dmp

Filesize
73.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads