systembc | 26ba2f4aed0d0811156c5441253c80c64e3ceb3ce6361e972a073e97916bc2bb

Analysis

Target

26ba2f4aed0d0811156c5441253c80c64e3ceb3ce6361e972a073e97916bc2bb.exe
Size

158KB
MD5

b382a33fc78de7cedcb81cd03ff017a7
SHA1

bd278d914b20167533b9eb419bfd7e7035e2648d
SHA256

26ba2f4aed0d0811156c5441253c80c64e3ceb3ce6361e972a073e97916bc2bb
SHA512

99e674d83d62430e9ce2105885445c599ae1c4bd9c41c486dad47a2f450d91859aa5d38f0140f1b788dfa8eeee6b425b52ac92cc2c7188fd23729c88f0ee24d8

Score

10^/10

systembc trojan

Family

systembc

91.212.150.113:4199

192.53.123.202:4199

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

26ba2f4aed0d0811156c5441253c80c64e3ceb3ce6361e972a073e97916bc2bb.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	26ba2f4aed0d0811156c5441253c80c64e3ceb3ce6361e972a073e97916bc2bb.exe
File opened for modification	C:\Windows\Tasks\wow64.job	26ba2f4aed0d0811156c5441253c80c64e3ceb3ce6361e972a073e97916bc2bb.exe

C:\Users\Admin\AppData\Local\Temp\26ba2f4aed0d0811156c5441253c80c64e3ceb3ce6361e972a073e97916bc2bb.exe
"C:\Users\Admin\AppData\Local\Temp\26ba2f4aed0d0811156c5441253c80c64e3ceb3ce6361e972a073e97916bc2bb.exe"
1⤵
- Drops file in Windows directory
PID:3280

C:\Users\Admin\AppData\Local\Temp\26ba2f4aed0d0811156c5441253c80c64e3ceb3ce6361e972a073e97916bc2bb.exe
C:\Users\Admin\AppData\Local\Temp\26ba2f4aed0d0811156c5441253c80c64e3ceb3ce6361e972a073e97916bc2bb.exe start
1⤵
PID:1184

memory/1184-118-0x0000000000490000-0x00000000005DA000-memory.dmp

Filesize
1.3MB

Download
memory/1184-119-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3280-115-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/3280-117-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3280-116-0x0000000002160000-0x0000000002165000-memory.dmp

Filesize
20KB

Download