systembc | 89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8

Analysis

Target

89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe
Size

80KB
MD5

eeba84917c10f83b80625d288201a85f
SHA1

043b34dafb1e23388c34fc9523cad171fa4b507c
SHA256

89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8
SHA512

753c310eb1ada398972546a37c44e94bcf0bd8a550bd559ba6bc304eb6930c3938b8c5acee81a245b8e1ff9bb811e6feb0a0d8f36d0029fc34be981794d8a0d6

Score

10^/10

systembc trojan

Family

systembc

devstudiakomp.com:4138

devstudiakomp.xyz:4138

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

kpndw.exe

pid process

5092 kpndw.exe

pid	process
5092	kpndw.exe

Drops file in Windows directory 2 IoCs

Processes:

89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe

description	ioc	process
File created	C:\Windows\Tasks\kpndw.job	89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe
File opened for modification	C:\Windows\Tasks\kpndw.job	89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1368 4768 WerFault.exe 89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe

pid	pid_target	process	target process
1368	4768	WerFault.exe	89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe

C:\Users\Admin\AppData\Local\Temp\89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe
"C:\Users\Admin\AppData\Local\Temp\89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe"
1⤵
- Drops file in Windows directory
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 480
2⤵
- Program crash
PID:1368

C:\ProgramData\undxv\kpndw.exe
C:\ProgramData\undxv\kpndw.exe start
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4768 -ip 4768
1⤵
PID:3068

C:\ProgramData\undxv\kpndw.exe
Filesize
80KB

MD5
eeba84917c10f83b80625d288201a85f

SHA1
043b34dafb1e23388c34fc9523cad171fa4b507c

SHA256
89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8

SHA512
753c310eb1ada398972546a37c44e94bcf0bd8a550bd559ba6bc304eb6930c3938b8c5acee81a245b8e1ff9bb811e6feb0a0d8f36d0029fc34be981794d8a0d6

Download Submit
C:\ProgramData\undxv\kpndw.exe
Filesize
80KB

MD5
eeba84917c10f83b80625d288201a85f

SHA1
043b34dafb1e23388c34fc9523cad171fa4b507c

SHA256
89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8

SHA512
753c310eb1ada398972546a37c44e94bcf0bd8a550bd559ba6bc304eb6930c3938b8c5acee81a245b8e1ff9bb811e6feb0a0d8f36d0029fc34be981794d8a0d6

Download Submit
memory/4768-131-0x00000000032D8000-0x00000000032DC000-memory.dmp

Filesize
16KB

Download
memory/4768-133-0x0000000003120000-0x0000000003125000-memory.dmp

Filesize
20KB

Download
memory/4768-132-0x00000000032D8000-0x00000000032DC000-memory.dmp

Filesize
16KB

Download
memory/4768-134-0x0000000000400000-0x0000000002F9E000-memory.dmp

Filesize
43.6MB

Download
memory/5092-139-0x0000000003850000-0x0000000003855000-memory.dmp

Filesize
20KB

Download
memory/5092-138-0x0000000002FA0000-0x00000000030A0000-memory.dmp

Filesize
1024KB

Download
memory/5092-140-0x0000000000400000-0x0000000002F9E000-memory.dmp

Filesize
43.6MB

Download