systembc | 3c642364e0da70a678aea937735f5bc945c8973820e6cc4ff8a3a31eae45d4fa | Triage

Analysis

max time kernel
123s
max time network
146s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-12-2021 11:44

Sharing

Report Analysis Logs

General

Target

3c642364e0da70a678aea937735f5bc945c8973820e6cc4ff8a3a31eae45d4fa.exe
Size

123KB
MD5

2b8c1c80169614e46daf2791ae19b0bf
SHA1

f3f5b926b2ae173c6345f6555c0c54b89901353c
SHA256

3c642364e0da70a678aea937735f5bc945c8973820e6cc4ff8a3a31eae45d4fa
SHA512

9505c0568ff4d8e96cf0365b316a9a4787552042ec4621b9cff17f8ee1b96658896b85809b37b6514919f1ec86f4980a6d301079cd02dc44f9bf550da5d4fbcc

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

185.70.184.41:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

3c642364e0da70a678aea937735f5bc945c8973820e6cc4ff8a3a31eae45d4fa.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	3c642364e0da70a678aea937735f5bc945c8973820e6cc4ff8a3a31eae45d4fa.exe
File opened for modification	C:\Windows\Tasks\wow64.job	3c642364e0da70a678aea937735f5bc945c8973820e6cc4ff8a3a31eae45d4fa.exe

C:\Users\Admin\AppData\Local\Temp\3c642364e0da70a678aea937735f5bc945c8973820e6cc4ff8a3a31eae45d4fa.exe
"C:\Users\Admin\AppData\Local\Temp\3c642364e0da70a678aea937735f5bc945c8973820e6cc4ff8a3a31eae45d4fa.exe"
1⤵
- Drops file in Windows directory
PID:68

C:\Users\Admin\AppData\Local\Temp\3c642364e0da70a678aea937735f5bc945c8973820e6cc4ff8a3a31eae45d4fa.exe
C:\Users\Admin\AppData\Local\Temp\3c642364e0da70a678aea937735f5bc945c8973820e6cc4ff8a3a31eae45d4fa.exe start
1⤵
PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/68-116-0x0000000000850000-0x0000000000855000-memory.dmp

Filesize
20KB

Download
memory/68-115-0x0000000000030000-0x0000000000036000-memory.dmp

Filesize
24KB

Download
memory/68-117-0x0000000000400000-0x0000000000810000-memory.dmp

Filesize
4.1MB

Download
memory/1012-118-0x0000000000400000-0x0000000000810000-memory.dmp

Filesize
4.1MB

Download