systembc | c25fcb9ebf8f56a91294910d0376986ca305ef1f7ce92750a19edec9a0d0c659

Resubmissions

21-12-2022 13:15

21-12-2022 02:23

max time kernel
43s
max time network
260s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-12-2022 02:23

Target

syncfiles32.dll
Size

6.8MB
MD5

cc4eb5690903e06b55c7aded2023b88f
SHA1

0ad6db10bb08bda4bdb58bc609e1c10a1d97f859
SHA256

c25fcb9ebf8f56a91294910d0376986ca305ef1f7ce92750a19edec9a0d0c659
SHA512

0fbc292d3e754a388a11f052b5b0e58d66b3e2f35464e6c2736b3b2d0510e01240f945f2269e8a22bfad73a91024801da688a387a65f791f7d85d0ee91040408
SSDEEP

196608:Hf4HBWmiaZGDsFQKCT7IRSwMeDoegfaJ88:HfSBBgGQKlRieEegS28

Score

10^/10

systembc trojan

Family

systembc

89.22.236.225:4193

176.124.205.5:4193

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

1 1340 rundll32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

rundll32.exe

pid process

1340 rundll32.exe
1340 rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1340 rundll32.exe

flow	pid	process
1	1340	rundll32.exe

pid	process
1340	rundll32.exe
1340	rundll32.exe

pid	process
1340	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1340	1652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\syncfiles32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

memory/1340-54-0x0000000000000000-mapping.dmp

Download
memory/1340-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1340-56-0x0000000010000000-0x0000000010A7D000-memory.dmp

Filesize
10.5MB

Download