systembc | 722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287

Resubmissions

17-04-2024 12:21

240417-pjbxssee52 10

17-04-2024 12:20

17-04-2024 12:20

17-04-2024 12:20

17-04-2024 12:20

17-04-2024 06:15

Analysis

max time kernel
223s
max time network
243s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
17-04-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe
Size

856KB
MD5

f7d59f44fee4981011624cfad18f5337
SHA1

db1cb01bfb123b2f5fb1240d57f263573d90433f
SHA256

722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287
SHA512

633774cda15ad084b8aa6cdde1783450c3bafdfb744cf3e79066632e785261f93e520b5a0f346623727f2158f562b691ab16b0e55bc209f364414843df929965
SSDEEP

1536:ysXQ0yVN2gV0GnoX1kPYqwtFUNn0WJWsa9tjUQukOVRct3Z3zAtp:xQX2gV1lwqaFFF9tjUXfVRo

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

asdasd08.com:4039

asdasd08.xyz:4039

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

mqtvac.exe

pid process

4544 mqtvac.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 api.ipify.org
15 api.ipify.org

pid	process
4544	mqtvac.exe

flow	ioc
1	api.ipify.org
15	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe

description	ioc	process
File created	C:\Windows\Tasks\mqtvac.job	722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe
File opened for modification	C:\Windows\Tasks\mqtvac.job	722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe

pid	process
2320	722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe
2320	722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe

C:\Users\Admin\AppData\Local\Temp\722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe
"C:\Users\Admin\AppData\Local\Temp\722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2320

C:\ProgramData\wasw\mqtvac.exe
C:\ProgramData\wasw\mqtvac.exe start
1⤵
- Executes dropped EXE
PID:4544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\wasw\mqtvac.exe
Filesize
856KB

MD5
f7d59f44fee4981011624cfad18f5337

SHA1
db1cb01bfb123b2f5fb1240d57f263573d90433f

SHA256
722aff7500dfce8737389cef11282becce37827df3ca9069b68bac66efb02287

SHA512
633774cda15ad084b8aa6cdde1783450c3bafdfb744cf3e79066632e785261f93e520b5a0f346623727f2158f562b691ab16b0e55bc209f364414843df929965

Download Submit