systembc | 52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436

Resubmissions

13-12-2022 18:17

221213-wxen6saa6x 10

12-12-2022 15:12

221212-slgslsbf53 10

Analysis

max time kernel
299s
max time network
303s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-12-2022 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436.exe
Size

240KB
MD5

ca810ef2745de0c5636e539a80fc3467
SHA1

28d303ec336b54aa0ed4796e93481f788428f4b3
SHA256

52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436
SHA512

58e788b25302a3c3f29dd95fab61c74ef3971d3ea654c66ca3446a878f29e129a286cf7170bde023435b9328f98224774089ff08005d957ae6245d02ab9c92de
SSDEEP

3072:cVvnL5hvxGKtzu5vP5XNfO3uvIjpgxGvQjohdBcf0EmoZgRbR8pgX:aLNGKtUdG3uv8pgxmQjoyftccpgX

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

109.205.214.18:443

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

dnlf.exe

pid process

1124 dnlf.exe

pid	process
1124	dnlf.exe

Drops file in Windows directory 2 IoCs

Processes:

52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436.exe

description	ioc	process
File created	C:\Windows\Tasks\dnlf.job	52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436.exe
File opened for modification	C:\Windows\Tasks\dnlf.job	52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436.exe

pid process

1996 52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436.exe

pid	process
1996	52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1480 wrote to memory of 1124	1480	taskeng.exe	dnlf.exe
PID 1480 wrote to memory of 1124	1480	taskeng.exe	dnlf.exe
PID 1480 wrote to memory of 1124	1480	taskeng.exe	dnlf.exe
PID 1480 wrote to memory of 1124	1480	taskeng.exe	dnlf.exe

C:\Users\Admin\AppData\Local\Temp\52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436.exe
"C:\Users\Admin\AppData\Local\Temp\52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1996

C:\Windows\system32\taskeng.exe
taskeng.exe {610FC412-A23F-46E4-A370-6523079DEDBA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\ProgramData\orjfw\dnlf.exe
C:\ProgramData\orjfw\dnlf.exe start
2⤵
- Executes dropped EXE
PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\orjfw\dnlf.exe

Filesize
240KB

MD5
ca810ef2745de0c5636e539a80fc3467

SHA1
28d303ec336b54aa0ed4796e93481f788428f4b3

SHA256
52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436

SHA512
58e788b25302a3c3f29dd95fab61c74ef3971d3ea654c66ca3446a878f29e129a286cf7170bde023435b9328f98224774089ff08005d957ae6245d02ab9c92de

Download Submit
C:\ProgramData\orjfw\dnlf.exe

Filesize
240KB

MD5
ca810ef2745de0c5636e539a80fc3467

SHA1
28d303ec336b54aa0ed4796e93481f788428f4b3

SHA256
52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436

SHA512
58e788b25302a3c3f29dd95fab61c74ef3971d3ea654c66ca3446a878f29e129a286cf7170bde023435b9328f98224774089ff08005d957ae6245d02ab9c92de

Download Submit
memory/1124-64-0x0000000000508000-0x0000000000519000-memory.dmp

Filesize
68KB

Download
memory/1124-60-0x0000000000000000-mapping.dmp

Download
memory/1124-62-0x0000000000508000-0x0000000000519000-memory.dmp

Filesize
68KB

Download
memory/1124-65-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1124-67-0x0000000000508000-0x0000000000519000-memory.dmp

Filesize
68KB

Download
memory/1996-57-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1996-58-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1996-56-0x0000000000578000-0x0000000000589000-memory.dmp

Filesize
68KB

Download
memory/1996-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1996-54-0x0000000000578000-0x0000000000589000-memory.dmp

Filesize
68KB

Download
memory/1996-66-0x0000000000578000-0x0000000000589000-memory.dmp

Filesize
68KB

Download
memory/1996-68-0x0000000000578000-0x0000000000589000-memory.dmp

Filesize
68KB

Download