systembc | c1f83eca657eb74769e9df053eb430c11cbcb123004179f2196fec6f45e48099

Analysis

max time kernel
141s
max time network
150s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 18:49

Target

c1f83eca657eb74769e9df053eb430c11cbcb123004179f2196fec6f45e48099.dll
Size

900KB
MD5

eb8481241f6347275135e63babf426e7
SHA1

9619feea2a3af4d1d08116ee7053c11eb8039962
SHA256

c1f83eca657eb74769e9df053eb430c11cbcb123004179f2196fec6f45e48099
SHA512

45fa8f03d2a1752aed82bda562a710d33057ae82d316827c0d503f4fca868f13d9b8da5f612cc8290bd1bce1b9b33e85d3e96c328583e2b2bfdf275e0e5264f9
SSDEEP

24576:D41L5Y9ORyViS5qWJwQUW+aekXKdrxb4:w2YM2tYadrx

Score

10^/10

systembc trojan

Family

systembc

104.238.140.73:4177

149.28.72.85:4177

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Blocklisted process makes network request 13 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2012 wrote to memory of 2036	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2036	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2036	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2036	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2036	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2036	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2036	2012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1f83eca657eb74769e9df053eb430c11cbcb123004179f2196fec6f45e48099.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1f83eca657eb74769e9df053eb430c11cbcb123004179f2196fec6f45e48099.dll,#1
2⤵
- Blocklisted process makes network request
PID:2036

memory/2036-54-0x0000000000000000-mapping.dmp

Download
memory/2036-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/2036-56-0x0000000000860000-0x0000000000944000-memory.dmp

Filesize
912KB

Download
memory/2036-57-0x0000000000170000-0x0000000000176000-memory.dmp

Filesize
24KB

Download
memory/2036-58-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download