systembc | 33269c0773dc723ffa5be5a6319e81c7f724d03dbfd9b46a5d40452c4b08bc88

Analysis

Target

cde7fabb4f892a362c73ac6be75dd66d.exe
Size

645KB
MD5

cde7fabb4f892a362c73ac6be75dd66d
SHA1

5e83793c5b2a45e843d65b867e3da848c95718be
SHA256

33269c0773dc723ffa5be5a6319e81c7f724d03dbfd9b46a5d40452c4b08bc88
SHA512

e426355224cdb03f0f72475b3222c631fa0f3e1d53e8e9c59a92e3a1eb25412030ef6052249a454b607f890a3c1fa5e970affa60d67111db5ccd0dc189237e60

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

cde7fabb4f892a362c73ac6be75dd66d.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	cde7fabb4f892a362c73ac6be75dd66d.exe
File opened for modification	C:\Windows\Tasks\wow64.job	cde7fabb4f892a362c73ac6be75dd66d.exe

C:\Users\Admin\AppData\Local\Temp\cde7fabb4f892a362c73ac6be75dd66d.exe
"C:\Users\Admin\AppData\Local\Temp\cde7fabb4f892a362c73ac6be75dd66d.exe"
1⤵
- Drops file in Windows directory
PID:564

C:\Users\Admin\AppData\Local\Temp\cde7fabb4f892a362c73ac6be75dd66d.exe
C:\Users\Admin\AppData\Local\Temp\cde7fabb4f892a362c73ac6be75dd66d.exe start
1⤵
PID:708

memory/564-115-0x0000000002300000-0x0000000002305000-memory.dmp

Filesize
20KB

Download
memory/564-114-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/564-116-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/708-117-0x00000000004B0000-0x000000000055E000-memory.dmp

Filesize
696KB

Download
memory/708-119-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download