systembc | 44ef83980f2f14ebf8e2e4b0deaff2725a47a57608fc4d3c595db3bfa1fb4d79

General

Target
2026-08-30_380319b0f4b11add86d791a87441ed4e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.1MB
Sample260901-dpb9zascld
SHA256 44ef83980f2f14ebf8e2e4b0deaff2725a47a57608fc4d3c595db3bfa1fb4d79
MD5 380319b0f4b11add86d791a87441ed4e
SHA1 a95fee443bb5f7bbed1fc8b8aec2a5af748284f1
SHA512 7a3268c1fd6a24e41516dab91b634f8c8e29beff08c0547cee572986e24580198c2d5d266c2a91986550a7d67f841351d1dd8d1fe37c00b6ef1b811fa24cad6a
SSDEEP 3072:XBNre6fpc/1GL4NgT1JinUVfHs52s6UZJWsJIaEdK4T1:xBfpc/1GLZTIUVfHsbW/dKw
TLSH
T166455B0035D3C071D1A66575D825C6B84BA77CB2992259CF3ACA3BBE3F346D29E6430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery systembc suricata trojan

Malware Config

Extracted

Family

systembc

C2

admex175x.xyz:4044
servx278x.xyz:4044

Signatures

Family: SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 1 IoCs

pid	Process
456	rtevwo.exe

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 32 IoCs

Network activity triggered a Suricata alert

suricata

flow	pid	Process
100	456	rtevwo.exe
100	456	rtevwo.exe
69	456	rtevwo.exe
69	456	rtevwo.exe
71	456	rtevwo.exe
71	456	rtevwo.exe
108	456	rtevwo.exe
108	456	rtevwo.exe
21	456	rtevwo.exe
21	456	rtevwo.exe
49	456	rtevwo.exe
49	456	rtevwo.exe
58	456	rtevwo.exe
58	456	rtevwo.exe
81	456	rtevwo.exe
81	456	rtevwo.exe
83	456	rtevwo.exe
83	456	rtevwo.exe
110	456	rtevwo.exe
110	456	rtevwo.exe
112	456	rtevwo.exe
112	456	rtevwo.exe
122	456	rtevwo.exe
122	456	rtevwo.exe
106	456	rtevwo.exe
106	456	rtevwo.exe
37	456	rtevwo.exe
37	456	rtevwo.exe
64	456	rtevwo.exe
64	456	rtevwo.exe
90	456	rtevwo.exe
90	456	rtevwo.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	api.ipify.org
10	api.ipify.org

Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rtevwo.job	2026-08-30_380319b0f4b11add86d791a87441ed4e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Tasks\rtevwo.job	2026-08-30_380319b0f4b11add86d791a87441ed4e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Program crash 11 IoCs

pid	pid_target	Process	procid_target
952	2224	WerFault.exe	85
3832	456	WerFault.exe	90
3940	456	WerFault.exe	90
1356	2224	WerFault.exe	85
4028	2224	WerFault.exe	85
988	456	WerFault.exe	90
3812	456	WerFault.exe	90
4248	456	WerFault.exe	90
1172	2224	WerFault.exe	85
2400	2224	WerFault.exe	85
696	456	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_380319b0f4b11add86d791a87441ed4e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rtevwo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2224	2026-08-30_380319b0f4b11add86d791a87441ed4e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2224	2026-08-30_380319b0f4b11add86d791a87441ed4e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-30_380319b0f4b11add86d791a87441ed4e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_380319b0f4b11add86d791a87441ed4e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 476
  2⤵
  - Program crash
  PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 944
  2⤵
  - Program crash
  PID:1356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 956
  2⤵
  - Program crash
  PID:4028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 952
  2⤵
  - Program crash
  PID:1172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 496
  2⤵
  - Program crash
  PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2224 -ip 2224
1⤵
PID:4672

C:\ProgramData\fxqkt\rtevwo.exe
C:\ProgramData\fxqkt\rtevwo.exe start
1⤵
- Executes dropped EXE
- Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
- System Location Discovery: System Language Discovery
PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 492
  2⤵
  - Program crash
  PID:3832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 696
  2⤵
  - Program crash
  PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 864
  2⤵
  - Program crash
  PID:988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 884
  2⤵
  - Program crash
  PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 904
  2⤵
  - Program crash
  PID:4248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 924
  2⤵
  - Program crash
  PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 456 -ip 456
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 456 -ip 456
1⤵
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2224 -ip 2224
1⤵
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2224 -ip 2224
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 456 -ip 456
1⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 456 -ip 456
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2224 -ip 2224
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 456 -ip 456
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2224 -ip 2224
1⤵
PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 456 -ip 456
1⤵
PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Proxy

1

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rtevwo.exe

Path C:\ProgramData\fxqkt\rtevwo.exe
Size 1.1MB
SHA256 44ef83980f2f14ebf8e2e4b0deaff2725a47a57608fc4d3c595db3bfa1fb4d79
MD5 380319b0f4b11add86d791a87441ed4e
SHA1 a95fee443bb5f7bbed1fc8b8aec2a5af748284f1
SHA512 7a3268c1fd6a24e41516dab91b634f8c8e29beff08c0547cee572986e24580198c2d5d266c2a91986550a7d67f841351d1dd8d1fe37c00b6ef1b811fa24cad6a
SSDEEP 3072:XBNre6fpc/1GL4NgT1JinUVfHs52s6UZJWsJIaEdK4T1:xBfpc/1GLZTIUVfHsbW/dKw
TLSH
T166455B0035D3C071D1A66575D825C6B84BA77CB2992259CF3ACA3BBE3F346D29E6430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-13-0x0000000000400000-0x00000000047A8000-memory.dmp

Download

memory/2224-1-0x0000000004820000-0x0000000004826000-memory.dmp

Download

memory/2224-2-0x0000000004930000-0x0000000004939000-memory.dmp

Download

memory/2224-0-0x0000000000400000-0x00000000047A8000-memory.dmp

Download

memory/2224-3-0x0000000004820000-0x0000000004826000-memory.dmp

Download

memory/2224-8-0x0000000004930000-0x0000000004939000-memory.dmp

Download

memory/2224-7-0x0000000000400000-0x00000000047A8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads