systembc | e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763

General

Target

e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763.exe
Size

95KB
MD5

0fa62d99e9fa9e4da58a1e2a7dc3d5a9
SHA1

cf0f9fa093bc1a1ff51c368194e03c8bf66d6a73
SHA256

e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763
SHA512

58fb9d1689a69bd63bea760cefadc18d3821e545b1540f166e63f65e480b62a3e36e6a327539dd0ae729c073d38d497e2ac091b6fec6a044fe8be0bb9e66b729

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

dasdasd28asd.com:4035

sasdcs28sd.xyz:4035

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

ebvb.exe

pid process

1752 ebvb.exe
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 ip4.seeip.org
6 api.ipify.org
7 api.ipify.org
8 ip4.seeip.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
1752	ebvb.exe

flow	ioc
9	ip4.seeip.org
6	api.ipify.org
7	api.ipify.org
8	ip4.seeip.org

Drops file in Windows directory 2 IoCs

Processes:

e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763.exe

description	ioc	process
File created	C:\Windows\Tasks\ebvb.job	e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763.exe
File opened for modification	C:\Windows\Tasks\ebvb.job	e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763.exe

pid process

2020 e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763.exe

pid	process
2020	e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1072 wrote to memory of 1752	1072	taskeng.exe	ebvb.exe
PID 1072 wrote to memory of 1752	1072	taskeng.exe	ebvb.exe
PID 1072 wrote to memory of 1752	1072	taskeng.exe	ebvb.exe
PID 1072 wrote to memory of 1752	1072	taskeng.exe	ebvb.exe

C:\Users\Admin\AppData\Local\Temp\e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763.exe
"C:\Users\Admin\AppData\Local\Temp\e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2020

C:\Windows\system32\taskeng.exe
taskeng.exe {728A341D-8797-4900-983C-E32F5B0A1679} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1072

C:\ProgramData\nncuv\ebvb.exe
C:\ProgramData\nncuv\ebvb.exe start
2⤵
- Executes dropped EXE
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

1

T1090

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\nncuv\ebvb.exe
Filesize
95KB

MD5
0fa62d99e9fa9e4da58a1e2a7dc3d5a9

SHA1
cf0f9fa093bc1a1ff51c368194e03c8bf66d6a73

SHA256
e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763

SHA512
58fb9d1689a69bd63bea760cefadc18d3821e545b1540f166e63f65e480b62a3e36e6a327539dd0ae729c073d38d497e2ac091b6fec6a044fe8be0bb9e66b729

Download Submit
C:\ProgramData\nncuv\ebvb.exe
Filesize
95KB

MD5
0fa62d99e9fa9e4da58a1e2a7dc3d5a9

SHA1
cf0f9fa093bc1a1ff51c368194e03c8bf66d6a73

SHA256
e71a3a3daea6774b51d0e10142ce3ef4168175ef3415fd095a1e5c0486f02763

SHA512
58fb9d1689a69bd63bea760cefadc18d3821e545b1540f166e63f65e480b62a3e36e6a327539dd0ae729c073d38d497e2ac091b6fec6a044fe8be0bb9e66b729

Download Submit
memory/1752-59-0x0000000000000000-mapping.dmp

Download
memory/1752-63-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1752-62-0x000000000105B000-0x0000000001062000-memory.dmp

Filesize
28KB

Download
memory/1752-64-0x0000000000400000-0x0000000000F75000-memory.dmp

Filesize
11.5MB

Download
memory/2020-54-0x000000000108B000-0x0000000001092000-memory.dmp

Filesize
28KB

Download
memory/2020-55-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/2020-56-0x0000000074DD1000-0x0000000074DD3000-memory.dmp

Filesize
8KB

Download
memory/2020-57-0x0000000000400000-0x0000000000F75000-memory.dmp

Filesize
11.5MB

Download

Analysis

Sharing