systembc | 77eb3eb81fb496c86ee1578e57ac0251e38540613a3a5a0d5f3d362fa81a693f

Analysis

max time kernel
141s
max time network
95s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/03/2023, 10:44

Target

redit.exe
Size

408KB
MD5

9ff723d163e9396f0864cdb77508e8f3
SHA1

878bb73586db91ab9867d4bda793377eff1344a1
SHA256

77eb3eb81fb496c86ee1578e57ac0251e38540613a3a5a0d5f3d362fa81a693f
SHA512

5e7213200bdadd4288f338fc9cb3c66f8a40138690e159d8b708ea3ff47a141332bf62513219d65b058b06ff870662a6ff265ada47fc7af399e3bcfa5e88e20e
SSDEEP

3072:9Fs0W8pkw2l2GbTnK4I/qvk4j7/2oDnbA6I9Drxi6NxTY9qo+v5YF4WqH+:9rZpkT2GXnY/qvk4Wqn3win97++

Score

10^/10

systembc trojan

Family

systembc

212.118.36.165:4193

46.151.26.42:4193

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1928	1976	redit.exe	28

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1976	redit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	redit.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1928	1976	redit.exe	28
PID 1976 wrote to memory of 1928	1976	redit.exe	28
PID 1976 wrote to memory of 1928	1976	redit.exe	28
PID 1976 wrote to memory of 1928	1976	redit.exe	28
PID 1976 wrote to memory of 1928	1976	redit.exe	28

C:\Users\Admin\AppData\Local\Temp\redit.exe
"C:\Users\Admin\AppData\Local\Temp\redit.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\redit.exe
  "C:\Users\Admin\AppData\Local\Temp\redit.exe"
  2⤵
  PID:1928

memory/1928-57-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1928-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1928-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1928-63-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1928-64-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1976-56-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1976-59-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download