systembc | 77eb3eb81fb496c86ee1578e57ac0251e38540613a3a5a0d5f3d362fa81a693f

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2023, 10:44

Target

redit.exe
Size

408KB
MD5

9ff723d163e9396f0864cdb77508e8f3
SHA1

878bb73586db91ab9867d4bda793377eff1344a1
SHA256

77eb3eb81fb496c86ee1578e57ac0251e38540613a3a5a0d5f3d362fa81a693f
SHA512

5e7213200bdadd4288f338fc9cb3c66f8a40138690e159d8b708ea3ff47a141332bf62513219d65b058b06ff870662a6ff265ada47fc7af399e3bcfa5e88e20e
SSDEEP

3072:9Fs0W8pkw2l2GbTnK4I/qvk4j7/2oDnbA6I9Drxi6NxTY9qo+v5YF4WqH+:9rZpkT2GXnY/qvk4Wqn3win97++

Score

10^/10

systembc trojan

Family

systembc

212.118.36.165:4193

46.151.26.42:4193

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 224 set thread context of 3496	224	redit.exe	102

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
224	redit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
224	redit.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3496	224	redit.exe	102
PID 224 wrote to memory of 3496	224	redit.exe	102
PID 224 wrote to memory of 3496	224	redit.exe	102
PID 224 wrote to memory of 3496	224	redit.exe	102

C:\Users\Admin\AppData\Local\Temp\redit.exe
"C:\Users\Admin\AppData\Local\Temp\redit.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\redit.exe
  "C:\Users\Admin\AppData\Local\Temp\redit.exe"
  2⤵
  PID:3496

memory/224-135-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/224-141-0x0000000000A80000-0x0000000000A86000-memory.dmp

Filesize
24KB

Download
memory/3496-136-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3496-138-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3496-140-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3496-142-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/3496-143-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download