systembc | ae8bce2c950ea683276425246918a82935cb7214d08190d5996e31876208ab77

Analysis

max time kernel
83s
max time network
145s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
16-03-2023 08:39

Target

ae8bce2c950ea683276425246918a82935cb7214d08190d5996e31876208ab77.dll
Size

12.4MB
MD5

3b3d7619eb68e228800d9c3f5ac23ee3
SHA1

3007b4cd5ab4d940e2cf9e116134f22deda586ea
SHA256

ae8bce2c950ea683276425246918a82935cb7214d08190d5996e31876208ab77
SHA512

a37c4e9ff41b51803f34f7257a830d54bb50bd73f019e6bde80e86f6ed23660d2d1e3cf0fa695372648bef05175b7c9e41f1a92f9c7e88331ff16d54ed6d6fee
SSDEEP

393216:jDGjz5THB+jnTTxLH143tmCHbJ/CCGKan9I:jgdTHB6nTTpstHwCI9I

Score

10^/10

systembc trojan

Family

systembc

79.137.203.32:4289

localhost.exchange:4289

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

7 4048 rundll32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

rundll32.exe

pid process

4048 rundll32.exe
4048 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4048 rundll32.exe
4048 rundll32.exe

flow	pid	process
7	4048	rundll32.exe

pid	process
4048	rundll32.exe
4048	rundll32.exe

pid	process
4048	rundll32.exe
4048	rundll32.exe

memory/4048-120-0x00007FF986560000-0x00007FF986562000-memory.dmp

Filesize
8KB

Download
memory/4048-121-0x00007FF986570000-0x00007FF986572000-memory.dmp

Filesize
8KB

Download
memory/4048-122-0x00007FF969DB0000-0x00007FF96B0E6000-memory.dmp

Filesize
19.2MB

Download