systembc | a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101

max time kernel
133s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2023 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2579be109c1035cb96942951710020a8.exe
Size

147KB
MD5

2579be109c1035cb96942951710020a8
SHA1

6987472967c8ce5e3d5fd6730a9da2964afacd10
SHA256

a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101
SHA512

191ea3d7edc69f1cb9d1ec4967074667c5e1c6b02fdaa8bbc5a4414bf5ca00ccafadc49670c5b3065133915d78e482572545f1d0c8c3382e6a767c1f08a33a21
SSDEEP

3072:9NuSXw/c4JHdNX8PAzCABaxg0r27f8EjQspDNJJAksa:9oSXw/hfNXmAzbYg02Ok

Score

10^/10

systembc trojan upx

Malware Config

Extracted

Family

systembc

advertspace10.club:4044

logstat17.club:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 2 IoCs

Processes:

kxgdup.exekxgdup.exe

pid process

588 kxgdup.exe
4200 kxgdup.exe

pid	process
588	kxgdup.exe
4200	kxgdup.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2240-132-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral2/memory/2240-133-0x0000000000400000-0x000000000044D000-memory.dmp	upx
C:\ProgramData\ewccrv\kxgdup.exe	upx
C:\ProgramData\ewccrv\kxgdup.exe	upx
behavioral2/memory/588-138-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral2/memory/588-139-0x0000000000400000-0x000000000044D000-memory.dmp	upx
C:\ProgramData\ewccrv\kxgdup.exe	upx
behavioral2/memory/4200-144-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral2/memory/4200-145-0x0000000000400000-0x000000000044D000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

Processes:

2579be109c1035cb96942951710020a8.exe

description	ioc	process
File created	C:\Windows\Tasks\kxgdup.job	2579be109c1035cb96942951710020a8.exe
File opened for modification	C:\Windows\Tasks\kxgdup.job	2579be109c1035cb96942951710020a8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2579be109c1035cb96942951710020a8.exe

pid process

2240 2579be109c1035cb96942951710020a8.exe
2240 2579be109c1035cb96942951710020a8.exe

pid	process
2240	2579be109c1035cb96942951710020a8.exe
2240	2579be109c1035cb96942951710020a8.exe

C:\Users\Admin\AppData\Local\Temp\2579be109c1035cb96942951710020a8.exe
"C:\Users\Admin\AppData\Local\Temp\2579be109c1035cb96942951710020a8.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2240

C:\ProgramData\ewccrv\kxgdup.exe
C:\ProgramData\ewccrv\kxgdup.exe start2
1⤵
- Executes dropped EXE
PID:588

C:\ProgramData\ewccrv\kxgdup.exe
C:\ProgramData\ewccrv\kxgdup.exe start2
1⤵
- Executes dropped EXE
PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ewccrv\kxgdup.exe
Filesize
147KB

MD5
2579be109c1035cb96942951710020a8

SHA1
6987472967c8ce5e3d5fd6730a9da2964afacd10

SHA256
a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101

SHA512
191ea3d7edc69f1cb9d1ec4967074667c5e1c6b02fdaa8bbc5a4414bf5ca00ccafadc49670c5b3065133915d78e482572545f1d0c8c3382e6a767c1f08a33a21

Download Submit
C:\ProgramData\ewccrv\kxgdup.exe
Filesize
147KB

MD5
2579be109c1035cb96942951710020a8

SHA1
6987472967c8ce5e3d5fd6730a9da2964afacd10

SHA256
a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101

SHA512
191ea3d7edc69f1cb9d1ec4967074667c5e1c6b02fdaa8bbc5a4414bf5ca00ccafadc49670c5b3065133915d78e482572545f1d0c8c3382e6a767c1f08a33a21

Download Submit
C:\ProgramData\ewccrv\kxgdup.exe
Filesize
147KB

MD5
2579be109c1035cb96942951710020a8

SHA1
6987472967c8ce5e3d5fd6730a9da2964afacd10

SHA256
a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101

SHA512
191ea3d7edc69f1cb9d1ec4967074667c5e1c6b02fdaa8bbc5a4414bf5ca00ccafadc49670c5b3065133915d78e482572545f1d0c8c3382e6a767c1f08a33a21

Download Submit
memory/588-139-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/588-142-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/588-140-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/588-138-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2240-135-0x0000000000AF0000-0x0000000000B24000-memory.dmp

Filesize
208KB

Download
memory/2240-132-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2240-141-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2240-134-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2240-133-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4200-144-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4200-145-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4200-146-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download