systembc | ef464ed72b73590e6f1fe174116e925258d742e2de02a7684aa841015db767e6 | Triage

Analysis

max time kernel
121s
max time network
137s
platform
windows10_x64
resource
win10-en-20211104
submitted
13-11-2021 08:31

Sharing

Report Analysis Logs

General

Target

7.exe
Size

185KB
MD5

2207d926147a8ff6327a728a32f0365f
SHA1

f7222a178adf853494700d6375d42adca3289c30
SHA256

ef464ed72b73590e6f1fe174116e925258d742e2de02a7684aa841015db767e6
SHA512

cc5be59c9ad4426c6cac4f5421e6f4b1335e8cc62f8bf771526394dd2ada7520c77763bc948ad7f2e6600fb6ee13a65a86c160973911a39ffee31904123d3f80

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

178.20.41.173:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Drops file in Windows directory 2 IoCs

Processes:

7.exe

description ioc process

File opened for modification C:\Windows\Tasks\wow64.job 7.exe
File created C:\Windows\Tasks\wow64.job 7.exe

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
1⤵
- Drops file in Windows directory
PID:2564

C:\Users\Admin\AppData\Local\Temp\7.exe
C:\Users\Admin\AppData\Local\Temp\7.exe start
1⤵
PID:660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-121-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2564-119-0x0000000002020000-0x0000000002025000-memory.dmp

Filesize
20KB

Download
memory/2564-120-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2564-118-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download