systembc | 073bc58ee928f589d0ed4fc556df8d11477c29590c5239bbb02392fcfe88458c

Resubmissions

27-12-2021 06:52

27-10-2021 06:35

25-10-2021 05:54

Target

073bc58ee928f589d0ed4fc556df8d11477c29590c5239bbb02392fcfe88458c.exe
Size

331KB
MD5

bf03442f038443b9e4eff1081bb51c38
SHA1

c0c66486acc3c13ab842cb13a2a40ce316b7fc00
SHA256

073bc58ee928f589d0ed4fc556df8d11477c29590c5239bbb02392fcfe88458c
SHA512

3eb5a6272b091e7a6a132dd09ed9d5739d67a6fc31a5289e63f4f0393288e4c44048a616c3514bddb8b0675b14c858224444d2926d38eeb1ad7a9c5d4307d733

Score

10^/10

systembc trojan

Family

systembc

185.173.39.49:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

073bc58ee928f589d0ed4fc556df8d11477c29590c5239bbb02392fcfe88458c.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	073bc58ee928f589d0ed4fc556df8d11477c29590c5239bbb02392fcfe88458c.exe
File opened for modification	C:\Windows\Tasks\wow64.job	073bc58ee928f589d0ed4fc556df8d11477c29590c5239bbb02392fcfe88458c.exe

C:\Users\Admin\AppData\Local\Temp\073bc58ee928f589d0ed4fc556df8d11477c29590c5239bbb02392fcfe88458c.exe
"C:\Users\Admin\AppData\Local\Temp\073bc58ee928f589d0ed4fc556df8d11477c29590c5239bbb02392fcfe88458c.exe"
1⤵
- Drops file in Windows directory
PID:828

C:\Users\Admin\AppData\Local\Temp\073bc58ee928f589d0ed4fc556df8d11477c29590c5239bbb02392fcfe88458c.exe
C:\Users\Admin\AppData\Local\Temp\073bc58ee928f589d0ed4fc556df8d11477c29590c5239bbb02392fcfe88458c.exe start
1⤵
PID:1876

memory/828-115-0x0000000003126000-0x0000000003136000-memory.dmp

Filesize
64KB

Download
memory/828-116-0x0000000002DB0000-0x0000000002EFA000-memory.dmp

Filesize
1.3MB

Download
memory/828-117-0x0000000000400000-0x0000000002DAA000-memory.dmp

Filesize
41.7MB

Download
memory/1876-118-0x0000000002F6B000-0x0000000002F7C000-memory.dmp

Filesize
68KB

Download
memory/1876-119-0x0000000000400000-0x0000000002DAA000-memory.dmp

Filesize
41.7MB

Download