systembc | 2a9262660a612c10017d661e2cd82a2e1dabef943542e83bc0f72426622a761a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2023 15:55

Target

cd7f488588b891094c27999d19388be9.exe
Size

255KB
MD5

cd7f488588b891094c27999d19388be9
SHA1

8f6d5e96247d0bd8c04842727f08b9fdaf879d06
SHA256

2a9262660a612c10017d661e2cd82a2e1dabef943542e83bc0f72426622a761a
SHA512

b8d90f7b60d90d269239da9b8845d84e546da2135aa3f444e84efd52b347cc96d46440ed2f728489e281ffad1cf220697c6bfa57137c9f3e44632102a408d188
SSDEEP

3072:gXiPmaJUdsa8HFq56I7HOeRUmPzGiX4KE8Z8j7ynXum1FYRlufdUJ66H:UEmaJUN4Ir6BiX4K5yj7ynXLFYQ+Jl

Score

10^/10

systembc trojan

Family

systembc

45.182.189.231:443

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

nvmnvo.exe

pid process

3592 nvmnvo.exe

pid	process
3592	nvmnvo.exe

Drops file in Windows directory 2 IoCs

Processes:

cd7f488588b891094c27999d19388be9.exe

description	ioc	process
File created	C:\Windows\Tasks\nvmnvo.job	cd7f488588b891094c27999d19388be9.exe
File opened for modification	C:\Windows\Tasks\nvmnvo.job	cd7f488588b891094c27999d19388be9.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3652 1692 WerFault.exe cd7f488588b891094c27999d19388be9.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cd7f488588b891094c27999d19388be9.exe

pid process

1692 cd7f488588b891094c27999d19388be9.exe
1692 cd7f488588b891094c27999d19388be9.exe

pid	pid_target	process	target process
3652	1692	WerFault.exe	cd7f488588b891094c27999d19388be9.exe

pid	process
1692	cd7f488588b891094c27999d19388be9.exe
1692	cd7f488588b891094c27999d19388be9.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 492
2⤵
- Program crash
PID:3652

C:\ProgramData\nvqq\nvmnvo.exe
C:\ProgramData\nvqq\nvmnvo.exe start
1⤵
- Executes dropped EXE
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1692 -ip 1692
1⤵
PID:1912

C:\ProgramData\nvqq\nvmnvo.exe
Filesize
255KB

MD5
cd7f488588b891094c27999d19388be9

SHA1
8f6d5e96247d0bd8c04842727f08b9fdaf879d06

SHA256
2a9262660a612c10017d661e2cd82a2e1dabef943542e83bc0f72426622a761a

SHA512
b8d90f7b60d90d269239da9b8845d84e546da2135aa3f444e84efd52b347cc96d46440ed2f728489e281ffad1cf220697c6bfa57137c9f3e44632102a408d188

Download Submit
C:\ProgramData\nvqq\nvmnvo.exe
Filesize
255KB

MD5
cd7f488588b891094c27999d19388be9

SHA1
8f6d5e96247d0bd8c04842727f08b9fdaf879d06

SHA256
2a9262660a612c10017d661e2cd82a2e1dabef943542e83bc0f72426622a761a

SHA512
b8d90f7b60d90d269239da9b8845d84e546da2135aa3f444e84efd52b347cc96d46440ed2f728489e281ffad1cf220697c6bfa57137c9f3e44632102a408d188

Download Submit
memory/1692-132-0x0000000002CA2000-0x0000000002CB7000-memory.dmp

Filesize
84KB

Download
memory/1692-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

Filesize
36KB

Download
memory/1692-134-0x0000000000400000-0x0000000002C2E000-memory.dmp

Filesize
40.2MB

Download
memory/1692-137-0x0000000002CA2000-0x0000000002CB7000-memory.dmp

Filesize
84KB

Download
memory/3592-138-0x0000000002DCD000-0x0000000002DE2000-memory.dmp

Filesize
84KB

Download
memory/3592-139-0x0000000000400000-0x0000000002C2E000-memory.dmp

Filesize
40.2MB

Download