systembc | 8ec28be6df1f0523887eb852fb19658b34bbeaf21c525be090666dd55b470a13

Analysis

max time kernel
143s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2023 20:58

Target

redit.exe
Size

402KB
MD5

7a07a5960a95b97a88558b9d95c8d242
SHA1

46c4850a9a75adf910c80507849a9329dbe861a4
SHA256

8ec28be6df1f0523887eb852fb19658b34bbeaf21c525be090666dd55b470a13
SHA512

c9282552cf6be663afbd6d0f4abd19301146836b00cb502c094d0ed3eb8b6b7d7fcaf105ab1ff6b4a8745749982f56a1d486b51ce29d6c08f9daaf7643114139
SSDEEP

3072:PI/YQk4jV9/QazsdKCj7/2oDnbA6I9Drxi6NxTY9qo+v5YFj7/2oDnbA6I9Drxiv:kPHnrsdKCWqn3win97PWqn3win97DZ

Score

10^/10

systembc trojan

Family

systembc

212.118.36.165:4193

46.151.26.42:4193

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Suspicious use of SetThreadContext 1 IoCs

Processes:

redit.exe

description pid process target process

PID 3752 set thread context of 2184 3752 redit.exe redit.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

redit.exe

pid process

3752 redit.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

redit.exe

pid process

3752 redit.exe

description	pid	process	target process
PID 3752 set thread context of 2184	3752	redit.exe	redit.exe

pid	process
3752	redit.exe

pid	process
3752	redit.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

redit.exe

description	pid	process	target process
PID 3752 wrote to memory of 2184	3752	redit.exe	redit.exe
PID 3752 wrote to memory of 2184	3752	redit.exe	redit.exe
PID 3752 wrote to memory of 2184	3752	redit.exe	redit.exe
PID 3752 wrote to memory of 2184	3752	redit.exe	redit.exe

C:\Users\Admin\AppData\Local\Temp\redit.exe
"C:\Users\Admin\AppData\Local\Temp\redit.exe"
2⤵
PID:2184

memory/2184-173-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2184-175-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2184-177-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2184-179-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/2184-180-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3752-139-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/3752-178-0x00000000005C0000-0x00000000005C4000-memory.dmp

Filesize
16KB

Download