systembc | dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab

General

Target

dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab.exe
Size

129KB
MD5

45c62274159056d7565d64faff15929e
SHA1

de96ebb4ca03273244dcd44ae140a0db52a7dfa2
SHA256

dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab
SHA512

81a2abd0d43463575f0db6885c9809bbdb462442a3675d3c825890d46064ada69a70cf4a6f73c75160565a768eb6eaad7a6f462f77d64e75ec1c70524c9f3b7a

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

sdadvert197.com:4044

mexstat128.com:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata
Executes dropped EXE 1 IoCs

Processes:

lkriui.exe

pid process

1536 lkriui.exe
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
7 ip4.seeip.org
8 ip4.seeip.org
5 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
1536	lkriui.exe

flow	ioc
6	api.ipify.org
7	ip4.seeip.org
8	ip4.seeip.org
5	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab.exe

description	ioc	process
File created	C:\Windows\Tasks\lkriui.job	dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab.exe
File opened for modification	C:\Windows\Tasks\lkriui.job	dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab.exe

pid process

1380 dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab.exe

pid	process
1380	dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1628 wrote to memory of 1536	1628	taskeng.exe	lkriui.exe
PID 1628 wrote to memory of 1536	1628	taskeng.exe	lkriui.exe
PID 1628 wrote to memory of 1536	1628	taskeng.exe	lkriui.exe
PID 1628 wrote to memory of 1536	1628	taskeng.exe	lkriui.exe

C:\Users\Admin\AppData\Local\Temp\dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab.exe
"C:\Users\Admin\AppData\Local\Temp\dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1380

C:\Windows\system32\taskeng.exe
taskeng.exe {8C34A666-166A-4F33-AF46-CCD76C046552} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\ProgramData\tcwnmxv\lkriui.exe
C:\ProgramData\tcwnmxv\lkriui.exe start
2⤵
- Executes dropped EXE
PID:1536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

1

T1090

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\tcwnmxv\lkriui.exe
Filesize
129KB

MD5
45c62274159056d7565d64faff15929e

SHA1
de96ebb4ca03273244dcd44ae140a0db52a7dfa2

SHA256
dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab

SHA512
81a2abd0d43463575f0db6885c9809bbdb462442a3675d3c825890d46064ada69a70cf4a6f73c75160565a768eb6eaad7a6f462f77d64e75ec1c70524c9f3b7a

Download Submit
C:\ProgramData\tcwnmxv\lkriui.exe
Filesize
129KB

MD5
45c62274159056d7565d64faff15929e

SHA1
de96ebb4ca03273244dcd44ae140a0db52a7dfa2

SHA256
dbe74212670f3e8b68dd6107f659c4de2be4dd68aab6f9446956e8f425bb2aab

SHA512
81a2abd0d43463575f0db6885c9809bbdb462442a3675d3c825890d46064ada69a70cf4a6f73c75160565a768eb6eaad7a6f462f77d64e75ec1c70524c9f3b7a

Download Submit
memory/1380-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1380-55-0x000000000090B000-0x0000000000912000-memory.dmp

Filesize
28KB

Download
memory/1380-56-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1380-57-0x0000000000400000-0x00000000007DD000-memory.dmp

Filesize
3.9MB

Download
memory/1536-59-0x0000000000000000-mapping.dmp

Download
memory/1536-62-0x00000000002EB000-0x00000000002F2000-memory.dmp

Filesize
28KB

Download
memory/1536-63-0x0000000000400000-0x00000000007DD000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing