systembc | 1f65b5b41f6821ecb05aa14f391939ad2d527c7b1b48c377a5a4647051c5ae84 | Triage

Analysis

max time kernel
144s
max time network
145s
platform
windows10_x64
resource
win10-en-20211104
submitted
06-12-2021 13:19

Sharing

Report Analysis Logs

General

Target

s 2.exe
Size

149KB
MD5

23e0db71f3d2182bb78ed5aaed6dbe31
SHA1

bdd3f63038f0c5cb80812289694da6e1d81b74ed
SHA256

1f65b5b41f6821ecb05aa14f391939ad2d527c7b1b48c377a5a4647051c5ae84
SHA512

03964f4dae03248bf3458d15334046632fc7ccc843f23f2b628a0e52aa162a347dfc5d7dd8307e98fa4e1cd17e9aa597513286859a6fbc2f9a124f9b54723ff3

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

45.156.26.59:4179

217.182.46.152:4179

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Drops file in Windows directory 2 IoCs

Processes:

s 2.exe

description ioc process

File created C:\Windows\Tasks\wow64.job s 2.exe
File opened for modification C:\Windows\Tasks\wow64.job s 2.exe

C:\Users\Admin\AppData\Local\Temp\s 2.exe
"C:\Users\Admin\AppData\Local\Temp\s 2.exe"
1⤵
- Drops file in Windows directory
PID:4128

C:\Users\Admin\AppData\Local\Temp\s 2.exe
"C:\Users\Admin\AppData\Local\Temp\s 2.exe" start
1⤵
PID:4280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4128-119-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download
memory/4128-118-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/4128-120-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4280-121-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download