systembc | 6779c5bd995a94b8e53173cd3be2e59adcca2f9775674dc681565eef4197627e

Resubmissions

02-03-2023 23:34

230302-3kwv9afd37 10

19-01-2023 12:39

230119-pvlw5sch4y 5

Analysis

max time kernel
1604s
max time network
1797s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-03-2023 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5ed2d8ade543409aa3ce182dd61a03e.exe
Size

1.3MB
MD5

b5ed2d8ade543409aa3ce182dd61a03e
SHA1

808c2ad2d0ffbb51a353bb7a8a4e6c52bbf8928e
SHA256

6779c5bd995a94b8e53173cd3be2e59adcca2f9775674dc681565eef4197627e
SHA512

89fcb252d3af7e38d536b67baac5d4eccae7a468cbf2e3381b8453d9a13aa2d556e95b13e352040947d5d62f11c6c60c1d8034dcdb9ebaf04005f144bf1e5e61
SSDEEP

24576:eAHnh+eWsN3skA4RV1Hom2KXMmHayQxvgyx7lfsc7du+VAjpT5:Jh+ZkldoPK8Ya3Bgy3fsc7du+V4z

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

212.118.36.165:4193

46.151.26.42:4193

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Suspicious use of SetThreadContext 1 IoCs

Processes:

b5ed2d8ade543409aa3ce182dd61a03e.exe

description pid process target process

PID 1720 set thread context of 1564 1720 b5ed2d8ade543409aa3ce182dd61a03e.exe InstallUtil.exe

description	pid	process	target process
PID 1720 set thread context of 1564	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

b5ed2d8ade543409aa3ce182dd61a03e.exe

description	pid	process	target process
PID 1720 wrote to memory of 1580	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1580	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1580	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1580	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1580	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1580	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1580	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1468	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1468	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1468	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1468	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1468	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1468	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1468	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1564	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1564	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1564	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1564	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1564	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1564	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1564	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1564	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe
PID 1720 wrote to memory of 1564	1720	b5ed2d8ade543409aa3ce182dd61a03e.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\b5ed2d8ade543409aa3ce182dd61a03e.exe
"C:\Users\Admin\AppData\Local\Temp\b5ed2d8ade543409aa3ce182dd61a03e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:1580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:1468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1564-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1564-59-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1564-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1564-63-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1720-62-0x0000000001171000-0x0000000001177000-memory.dmp

Filesize
24KB

Download