systembc | 5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca

Analysis

Target

5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe
Size

507KB
MD5

d8f3abf2c283de95b8f1b8474220adfd
SHA1

3ca1423519539f0c608e2cc6f35e7a5a5977edb4
SHA256

5a8bff61d763ebedce54e24428a041cb5276b5ffad92e009fd36203f122961ca
SHA512

e6c8883caf517ab98773b3b5be78d2aa3a1bd01c55576cb4fbcc75ba3a39cd09f60482307a3ebc83fd91a5f5aca7731b188b932979df5f495351d70346fd2557

Score

10^/10

systembc trojan

Family

systembc

mainscpnl.xyz:4207

backpscpnl.xyz:4207

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in System32 directory 2 IoCs

Processes:

5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Obsidium\{49E7EF38-814504E7-31140760-52C4F6AE}.1443228313920530249	5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\.obs32\{49E7EF38-814504E7-31140760-52C4F6AE}.1443228313920530249	5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe

Drops file in Windows directory 2 IoCs

Processes:

5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe
File opened for modification	C:\Windows\Tasks\wow64.job	5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe

C:\Users\Admin\AppData\Local\Temp\5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe
"C:\Users\Admin\AppData\Local\Temp\5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe"
1⤵
- Drops file in Windows directory
PID:2640

C:\Users\Admin\AppData\Local\Temp\5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe
C:\Users\Admin\AppData\Local\Temp\5a8bff61d763ebedce54e24428a041cb5276b5ffad92e.exe start
1⤵
- Drops file in System32 directory
PID:1824

memory/1824-127-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/1824-128-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1824-129-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/1824-135-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1824-134-0x0000000001120000-0x000000000115B000-memory.dmp

Filesize
236KB

Download
memory/2640-118-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2640-119-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2640-120-0x00000000006D0000-0x000000000081A000-memory.dmp

Filesize
1.3MB

Download
memory/2640-121-0x0000000000730000-0x0000000000737000-memory.dmp

Filesize
28KB

Download
memory/2640-126-0x00000000006D0000-0x000000000081A000-memory.dmp

Filesize
1.3MB

Download