systembc | 2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961

General

Target

2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961.exe
Size

289KB
MD5

375389bf695377358b96e03c5b091a6e
SHA1

c03751ce0025d329fc07c604d41cda77c03858b3
SHA256

2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961
SHA512

4c34f930fa6cc6eca979fb0b1d94384398f21674a93164a76825eff2b1e8a249534c941177920d4ca81defa4fc130e897a958e472185341354293ac7416bd30f

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

mdadvertx17.xyz:4044

pkspacex19.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 2 IoCs

Processes:

rlmbbs.exerlmbbs.exe

pid process

3580 rlmbbs.exe
3016 rlmbbs.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

43 api.ipify.org
44 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Connection Proxy
T1090

pid	process
3580	rlmbbs.exe
3016	rlmbbs.exe

flow	ioc
43	api.ipify.org
44	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961.exe

description	ioc	process
File created	C:\Windows\Tasks\rlmbbs.job	2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961.exe
File opened for modification	C:\Windows\Tasks\rlmbbs.job	2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1936	1648	WerFault.exe	2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961.exe
3396	3580	WerFault.exe	rlmbbs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961.exe

pid	process
1648	2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961.exe
1648	2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961.exe

C:\Users\Admin\AppData\Local\Temp\2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961.exe
"C:\Users\Admin\AppData\Local\Temp\2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 488
2⤵
- Program crash
PID:1936

C:\ProgramData\qblmvo\rlmbbs.exe
C:\ProgramData\qblmvo\rlmbbs.exe start2
1⤵
- Executes dropped EXE
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 488
2⤵
- Program crash
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1648 -ip 1648
1⤵
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3580 -ip 3580
1⤵
PID:408

C:\ProgramData\qblmvo\rlmbbs.exe
C:\ProgramData\qblmvo\rlmbbs.exe start2
1⤵
- Executes dropped EXE
PID:3016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

1

T1090

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\qblmvo\rlmbbs.exe
Filesize
289KB

MD5
375389bf695377358b96e03c5b091a6e

SHA1
c03751ce0025d329fc07c604d41cda77c03858b3

SHA256
2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961

SHA512
4c34f930fa6cc6eca979fb0b1d94384398f21674a93164a76825eff2b1e8a249534c941177920d4ca81defa4fc130e897a958e472185341354293ac7416bd30f

Download Submit
C:\ProgramData\qblmvo\rlmbbs.exe
Filesize
289KB

MD5
375389bf695377358b96e03c5b091a6e

SHA1
c03751ce0025d329fc07c604d41cda77c03858b3

SHA256
2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961

SHA512
4c34f930fa6cc6eca979fb0b1d94384398f21674a93164a76825eff2b1e8a249534c941177920d4ca81defa4fc130e897a958e472185341354293ac7416bd30f

Download Submit
C:\ProgramData\qblmvo\rlmbbs.exe
Filesize
289KB

MD5
375389bf695377358b96e03c5b091a6e

SHA1
c03751ce0025d329fc07c604d41cda77c03858b3

SHA256
2dd3e669bd3b9727e7b744198c7ad0399a89c5e4287f8572fb9f19aaca93c961

SHA512
4c34f930fa6cc6eca979fb0b1d94384398f21674a93164a76825eff2b1e8a249534c941177920d4ca81defa4fc130e897a958e472185341354293ac7416bd30f

Download Submit
memory/1648-131-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1648-132-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1648-133-0x00000000006D7000-0x00000000006DD000-memory.dmp

Filesize
24KB

Download
memory/1648-130-0x00000000006D7000-0x00000000006DD000-memory.dmp

Filesize
24KB

Download
memory/1648-138-0x00000000006D7000-0x00000000006DD000-memory.dmp

Filesize
24KB

Download
memory/3016-141-0x000000000055A000-0x0000000000560000-memory.dmp

Filesize
24KB

Download
memory/3016-143-0x000000000055A000-0x0000000000560000-memory.dmp

Filesize
24KB

Download
memory/3016-142-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/3580-136-0x0000000000786000-0x000000000078C000-memory.dmp

Filesize
24KB

Download
memory/3580-139-0x0000000000786000-0x000000000078C000-memory.dmp

Filesize
24KB

Download
memory/3580-137-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads