systembc | bc37b9feb0202a795c125de0396621dd839f21e4c7e4dd598c452f45cf803e97

Analysis

Target

zbetcheckin.exe
Size

515KB
MD5

1b457c64a5bb3a25bfae25a686cfcee0
SHA1

275a27c5500e0471780abb90d8c58feb0d5f251f
SHA256

bc37b9feb0202a795c125de0396621dd839f21e4c7e4dd598c452f45cf803e97
SHA512

7238e332e16886e1c8147ca8ed42f5c88fbf1bbb24d0dcd30748b3e4b817a5841bfdb0f4c4450c62b647da4ef53307691f11183819ff5d6b451933af14c4ace1

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Drops file in Windows directory 2 IoCs

Processes:

zbetcheckin.exe

description ioc process

File created C:\Windows\Tasks\wow64.job zbetcheckin.exe
File opened for modification C:\Windows\Tasks\wow64.job zbetcheckin.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	zbetcheckin.exe
File opened for modification	C:\Windows\Tasks\wow64.job	zbetcheckin.exe

C:\Users\Admin\AppData\Local\Temp\zbetcheckin.exe
"C:\Users\Admin\AppData\Local\Temp\zbetcheckin.exe"
1⤵
- Drops file in Windows directory
PID:908

C:\Users\Admin\AppData\Local\Temp\zbetcheckin.exe
C:\Users\Admin\AppData\Local\Temp\zbetcheckin.exe start
1⤵
PID:648

memory/648-117-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/648-119-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/908-114-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/908-115-0x00000000023E0000-0x00000000023E5000-memory.dmp

Filesize
20KB

Download
memory/908-116-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download