systembc | a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1

General

Target

a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe
Size

190KB
MD5

18bf71b4b6017218464aa69ece567f98
SHA1

5eab7974b0636568d2b96cf9eef6b6bacb8adb1b
SHA256

a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1
SHA512

5efff60513e55b0961602b2ecdadd04fb8e524e5e4f5dac34bde6a6504a94c6cc8b326a7b947022a9bfea334b67a32aed6282ea4d698da598bc54cf6635a8f74

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

sdadvert197.com:4044

mexstat128.com:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata
Executes dropped EXE 1 IoCs

Processes:

ldvqda.exe

pid process

3640 ldvqda.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

46 api.ipify.org
55 ip4.seeip.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
3640	ldvqda.exe

flow	ioc
46	api.ipify.org
55	ip4.seeip.org

Drops file in Windows directory 2 IoCs

Processes:

a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe

description	ioc	process
File created	C:\Windows\Tasks\ldvqda.job	a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe
File opened for modification	C:\Windows\Tasks\ldvqda.job	a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

504 4092 WerFault.exe a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe

pid	pid_target	process	target process
504	4092	WerFault.exe	a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe

pid	process
4092	a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe
4092	a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe

C:\Users\Admin\AppData\Local\Temp\a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe
"C:\Users\Admin\AppData\Local\Temp\a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 948
2⤵
- Program crash
PID:504

C:\ProgramData\vqgru\ldvqda.exe
C:\ProgramData\vqgru\ldvqda.exe start
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4092 -ip 4092
1⤵
PID:2076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

1

T1090

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vqgru\ldvqda.exe
Filesize
190KB

MD5
18bf71b4b6017218464aa69ece567f98

SHA1
5eab7974b0636568d2b96cf9eef6b6bacb8adb1b

SHA256
a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1

SHA512
5efff60513e55b0961602b2ecdadd04fb8e524e5e4f5dac34bde6a6504a94c6cc8b326a7b947022a9bfea334b67a32aed6282ea4d698da598bc54cf6635a8f74

Download Submit
C:\ProgramData\vqgru\ldvqda.exe
Filesize
190KB

MD5
18bf71b4b6017218464aa69ece567f98

SHA1
5eab7974b0636568d2b96cf9eef6b6bacb8adb1b

SHA256
a1d22e1aff7b55b24228a8da8851a8a0ee40449941123cccc59b50d8c58215a1

SHA512
5efff60513e55b0961602b2ecdadd04fb8e524e5e4f5dac34bde6a6504a94c6cc8b326a7b947022a9bfea334b67a32aed6282ea4d698da598bc54cf6635a8f74

Download Submit
memory/3640-136-0x0000000004F00000-0x0000000004F09000-memory.dmp

Filesize
36KB

Download
memory/3640-135-0x0000000004F63000-0x0000000004F69000-memory.dmp

Filesize
24KB

Download
memory/3640-137-0x0000000000400000-0x0000000004DAC000-memory.dmp

Filesize
73.7MB

Download
memory/4092-130-0x0000000004F48000-0x0000000004F4F000-memory.dmp

Filesize
28KB

Download
memory/4092-131-0x0000000006AE0000-0x0000000006AE9000-memory.dmp

Filesize
36KB

Download
memory/4092-132-0x0000000000400000-0x0000000004DAC000-memory.dmp

Filesize
73.7MB

Download

Analysis

Sharing