systembc | e03c7c137c9616dce7aa69a657cb3c7ef849931dc570d98d1467f5b0ace0841c | Triage

Analysis

max time kernel
120s
max time network
143s
platform
windows10_x64
resource
win10-en-20211104
submitted
11-11-2021 20:16

Sharing

Report Analysis Logs

General

Target

e03c7c137c9616dce7aa69a657cb3c7ef849931dc570d98d1467f5b0ace0841c.exe
Size

333KB
MD5

391e868c6dfce64177b2c9e7ccccceff
SHA1

d6be8b201ca0a69da4deb5aba4148b3aa0651c6a
SHA256

e03c7c137c9616dce7aa69a657cb3c7ef849931dc570d98d1467f5b0ace0841c
SHA512

3efb3fa9336e35d9025c0b5c85e73857650ca1bbbb6dba0a828e15a8b8f5abc1a7c924e0496365f7a276ae6dd279d79773118914ff64a4f360ac831f10025f46

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

91.212.150.113:4199

192.53.123.202:4199

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

e03c7c137c9616dce7aa69a657cb3c7ef849931dc570d98d1467f5b0ace0841c.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	e03c7c137c9616dce7aa69a657cb3c7ef849931dc570d98d1467f5b0ace0841c.exe
File opened for modification	C:\Windows\Tasks\wow64.job	e03c7c137c9616dce7aa69a657cb3c7ef849931dc570d98d1467f5b0ace0841c.exe

C:\Users\Admin\AppData\Local\Temp\e03c7c137c9616dce7aa69a657cb3c7ef849931dc570d98d1467f5b0ace0841c.exe
"C:\Users\Admin\AppData\Local\Temp\e03c7c137c9616dce7aa69a657cb3c7ef849931dc570d98d1467f5b0ace0841c.exe"
1⤵
- Drops file in Windows directory
PID:4268

C:\Users\Admin\AppData\Local\Temp\e03c7c137c9616dce7aa69a657cb3c7ef849931dc570d98d1467f5b0ace0841c.exe
C:\Users\Admin\AppData\Local\Temp\e03c7c137c9616dce7aa69a657cb3c7ef849931dc570d98d1467f5b0ace0841c.exe start
1⤵
PID:4336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4268-120-0x0000000000400000-0x0000000002B4B000-memory.dmp

Filesize
39.3MB

Download
memory/4268-119-0x0000000002BA0000-0x0000000002BA5000-memory.dmp

Filesize
20KB

Download
memory/4336-123-0x0000000000400000-0x0000000002B4B000-memory.dmp

Filesize
39.3MB

Download
memory/4336-122-0x0000000002B50000-0x0000000002BFE000-memory.dmp

Filesize
696KB

Download