systembc | d5ea30279fc37436f63d3c6275aad6a2c8abdcd32e10888200fae3e986cb9626 | Triage™

Analysis

max time kernel
143s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
01/12/2020, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e80b306acc8e716d906cdc517b64ca36.exe
Size 957KB
Sample201201-159fq8bewa
SHA256 d5ea30279fc37436f63d3c6275aad6a2c8abdcd32e10888200fae3e986cb9626
MD5 e80b306acc8e716d906cdc517b64ca36
SHA1 1955a7d549d010698ae87411655027b95ad806ce
SHA512 a454be1f398986791783193354657218e07d50c957144b79ccbd861a1989ed297fead21081e759ba4999ecef81b1ab2a5095bc1c1aa4b88179cd4d9a85a6c398
MD5 SHA1 SHA512

Score

10^/10

systembc trojan

Malware Config

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 1 IoCs

pid	Process
3440	oqnhq.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\oqnhq.job	e80b306acc8e716d906cdc517b64ca36.exe
File opened for modification	C:\Windows\Tasks\oqnhq.job	e80b306acc8e716d906cdc517b64ca36.exe

C:\Users\Admin\AppData\Local\Temp\e80b306acc8e716d906cdc517b64ca36.exe
"C:\Users\Admin\AppData\Local\Temp\e80b306acc8e716d906cdc517b64ca36.exe"
1⤵
- Drops file in Windows directory
PID:972

C:\ProgramData\xfxtg\oqnhq.exe
C:\ProgramData\xfxtg\oqnhq.exe start
1⤵
- Executes dropped EXE
PID:3440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads