systembc | c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec | Triage

Analysis

max time kernel
146s
max time network
147s
platform
windows10_x64
resource
win10v20210408
submitted
29-09-2021 05:56

Sharing

Report Analysis Logs

General

Target

c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec.exe
Size

117KB
MD5

1d29d6cd39010976adcb9fcba517f3bc
SHA1

86d13d8593d4eea9e5b8c9dca9a1d30c7c03f67c
SHA256

c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec
SHA512

fb332b210b5c8549097d55740d09ff06c9beabe40c2c020013e59f429df29c3b0cb7925de4eafb536b299361ea2b533c65a133ee6784e594574441ed04b09c48

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

195.2.76.80:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\wow64.job	c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec.exe
File created	C:\Windows\Tasks\wow64.job	c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec.exe

C:\Users\Admin\AppData\Local\Temp\c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec.exe
"C:\Users\Admin\AppData\Local\Temp\c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec.exe"
1⤵
- Drops file in Windows directory
PID:628

C:\Users\Admin\AppData\Local\Temp\c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec.exe
C:\Users\Admin\AppData\Local\Temp\c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec.exe start
1⤵
PID:784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-114-0x00000000004B0000-0x00000000005FA000-memory.dmp

Filesize
1.3MB

Download
memory/628-115-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/784-117-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/784-116-0x0000000000600000-0x0000000000605000-memory.dmp

Filesize
20KB

Download