systembc | d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045

Analysis

max time kernel
163s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-05-2022 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045.exe
Size

178KB
MD5

8a53ca14784db0d61dee57dbd1c38e54
SHA1

a60f41f04529432ae8e4577ba9f13bca904ab4e9
SHA256

d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045
SHA512

3947f8df002b02e7d5ee9df07d1fd93e7f8bf322d91f99a4069480498d61b3f42718790d7ec93100a29257339d1f9e2d61e0a98740b5a05fa5e994c280b868d8

Score

10^/10

systembc suricata trojan

Malware Config

Extracted

Family

systembc

sdadvert197.com:4044

mexstat128.com:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata
Executes dropped EXE 1 IoCs

Processes:

wmjhlor.exe

pid process

1416 wmjhlor.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

45 api.ipify.org
46 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
1416	wmjhlor.exe

flow	ioc
45	api.ipify.org
46	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045.exe

description	ioc	process
File created	C:\Windows\Tasks\wmjhlor.job	d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045.exe
File opened for modification	C:\Windows\Tasks\wmjhlor.job	d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045.exe

pid	process
3032	d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045.exe
3032	d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045.exe

C:\Users\Admin\AppData\Local\Temp\d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045.exe
"C:\Users\Admin\AppData\Local\Temp\d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3032

C:\ProgramData\caxpn\wmjhlor.exe
C:\ProgramData\caxpn\wmjhlor.exe start
1⤵
- Executes dropped EXE
PID:1416

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

T1090

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\caxpn\wmjhlor.exe
Filesize
178KB

MD5
8a53ca14784db0d61dee57dbd1c38e54

SHA1
a60f41f04529432ae8e4577ba9f13bca904ab4e9

SHA256
d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045

SHA512
3947f8df002b02e7d5ee9df07d1fd93e7f8bf322d91f99a4069480498d61b3f42718790d7ec93100a29257339d1f9e2d61e0a98740b5a05fa5e994c280b868d8

Download Submit
C:\ProgramData\caxpn\wmjhlor.exe
Filesize
178KB

MD5
8a53ca14784db0d61dee57dbd1c38e54

SHA1
a60f41f04529432ae8e4577ba9f13bca904ab4e9

SHA256
d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045

SHA512
3947f8df002b02e7d5ee9df07d1fd93e7f8bf322d91f99a4069480498d61b3f42718790d7ec93100a29257339d1f9e2d61e0a98740b5a05fa5e994c280b868d8

Download Submit
memory/1416-135-0x0000000004E73000-0x0000000004E79000-memory.dmp

Filesize
24KB

Download
memory/1416-136-0x0000000000400000-0x0000000004DA8000-memory.dmp

Filesize
73.7MB

Download
memory/3032-130-0x0000000004DF8000-0x0000000004DFF000-memory.dmp

Filesize
28KB

Download
memory/3032-131-0x0000000004F20000-0x0000000004F29000-memory.dmp

Filesize
36KB

Download
memory/3032-132-0x0000000000400000-0x0000000004DA8000-memory.dmp

Filesize
73.7MB

Download