systembc | 71c37b1d53f487f7b8c025ab8b3aca6635e3d1555b5961a5c9b56bbbeca9888f

Analysis

max time kernel
119s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2022 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0be0fc03b5e4097a0a60f89afd3ea9c.exe
Size

375KB
MD5

a0be0fc03b5e4097a0a60f89afd3ea9c
SHA1

dae6c080f184ffe61e62931084cef68a5e45dbb7
SHA256

71c37b1d53f487f7b8c025ab8b3aca6635e3d1555b5961a5c9b56bbbeca9888f
SHA512

0596fa6739a36d3505d821a7144ec90ed288a0b25667fdd5a0aad2491ba24c9118c55d4530d3636236685870c99c2603259cded573548b178d63f3c4c6cf851e
SSDEEP

6144:0bKbnMYcwtusRIUA3ku18D5kebj/juUe4WV5s+gVRfvV3PxD:0bgnFcoRIUMku18D9jrpzWV5JOfvhPd

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

rupertok.su:4083

podisong.su:4083

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 2 IoCs

Processes:

uqofdbf.exeuqofdbf.exe

pid process

4652 uqofdbf.exe
3728 uqofdbf.exe

pid	process
4652	uqofdbf.exe
3728	uqofdbf.exe

Drops file in Windows directory 2 IoCs

Processes:

a0be0fc03b5e4097a0a60f89afd3ea9c.exe

description	ioc	process
File created	C:\Windows\Tasks\uqofdbf.job	a0be0fc03b5e4097a0a60f89afd3ea9c.exe
File opened for modification	C:\Windows\Tasks\uqofdbf.job	a0be0fc03b5e4097a0a60f89afd3ea9c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a0be0fc03b5e4097a0a60f89afd3ea9c.exe

pid process

3464 a0be0fc03b5e4097a0a60f89afd3ea9c.exe
3464 a0be0fc03b5e4097a0a60f89afd3ea9c.exe

pid	process
3464	a0be0fc03b5e4097a0a60f89afd3ea9c.exe
3464	a0be0fc03b5e4097a0a60f89afd3ea9c.exe

C:\Users\Admin\AppData\Local\Temp\a0be0fc03b5e4097a0a60f89afd3ea9c.exe
"C:\Users\Admin\AppData\Local\Temp\a0be0fc03b5e4097a0a60f89afd3ea9c.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3464

C:\ProgramData\novsxs\uqofdbf.exe
C:\ProgramData\novsxs\uqofdbf.exe start2
1⤵
- Executes dropped EXE
PID:4652

C:\ProgramData\novsxs\uqofdbf.exe
C:\ProgramData\novsxs\uqofdbf.exe start2
1⤵
- Executes dropped EXE
PID:3728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\novsxs\uqofdbf.exe
Filesize
375KB

MD5
a0be0fc03b5e4097a0a60f89afd3ea9c

SHA1
dae6c080f184ffe61e62931084cef68a5e45dbb7

SHA256
71c37b1d53f487f7b8c025ab8b3aca6635e3d1555b5961a5c9b56bbbeca9888f

SHA512
0596fa6739a36d3505d821a7144ec90ed288a0b25667fdd5a0aad2491ba24c9118c55d4530d3636236685870c99c2603259cded573548b178d63f3c4c6cf851e

Download Submit
C:\ProgramData\novsxs\uqofdbf.exe
Filesize
375KB

MD5
a0be0fc03b5e4097a0a60f89afd3ea9c

SHA1
dae6c080f184ffe61e62931084cef68a5e45dbb7

SHA256
71c37b1d53f487f7b8c025ab8b3aca6635e3d1555b5961a5c9b56bbbeca9888f

SHA512
0596fa6739a36d3505d821a7144ec90ed288a0b25667fdd5a0aad2491ba24c9118c55d4530d3636236685870c99c2603259cded573548b178d63f3c4c6cf851e

Download Submit
C:\ProgramData\novsxs\uqofdbf.exe
Filesize
375KB

MD5
a0be0fc03b5e4097a0a60f89afd3ea9c

SHA1
dae6c080f184ffe61e62931084cef68a5e45dbb7

SHA256
71c37b1d53f487f7b8c025ab8b3aca6635e3d1555b5961a5c9b56bbbeca9888f

SHA512
0596fa6739a36d3505d821a7144ec90ed288a0b25667fdd5a0aad2491ba24c9118c55d4530d3636236685870c99c2603259cded573548b178d63f3c4c6cf851e

Download Submit
memory/3464-141-0x0000000000400000-0x00000000062E4000-memory.dmp

Filesize
94.9MB

Download
memory/3464-135-0x0000000000400000-0x00000000062E4000-memory.dmp

Filesize
94.9MB

Download
memory/3464-133-0x0000000006505000-0x000000000650C000-memory.dmp

Filesize
28KB

Download
memory/3464-132-0x0000000006505000-0x000000000650C000-memory.dmp

Filesize
28KB

Download
memory/3464-134-0x0000000006480000-0x0000000006485000-memory.dmp

Filesize
20KB

Download
memory/3728-144-0x0000000006677000-0x000000000667E000-memory.dmp

Filesize
28KB

Download
memory/3728-145-0x0000000006677000-0x000000000667E000-memory.dmp

Filesize
28KB

Download
memory/3728-146-0x0000000000400000-0x00000000062E4000-memory.dmp

Filesize
94.9MB

Download
memory/4652-138-0x0000000006424000-0x000000000642A000-memory.dmp

Filesize
24KB

Download
memory/4652-139-0x0000000006424000-0x000000000642A000-memory.dmp

Filesize
24KB

Download
memory/4652-140-0x0000000000400000-0x00000000062E4000-memory.dmp

Filesize
94.9MB

Download
memory/4652-142-0x0000000000400000-0x00000000062E4000-memory.dmp

Filesize
94.9MB

Download