systembc | ca958072c2483f5cfab83972b3e5a25a163eed2d0d6df7d310ddf200a6fec53c

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 09:14

Target

84499558c48c4fdebac20cab68253aa7.exe
Size

228KB
MD5

84499558c48c4fdebac20cab68253aa7
SHA1

d4518c621d32ebc483a8f0761cf6ed0fe3c7b8ce
SHA256

ca958072c2483f5cfab83972b3e5a25a163eed2d0d6df7d310ddf200a6fec53c
SHA512

00ad7c29108eb787d0283bb6a6c2955ff3b4a64254d03767c1c21e8bf3a1e14149958c9de8f4fd2f6489972b4573b07abc18a3bc2e96cba5fe2d4852d204d65a
SSDEEP

3072:psLU9af5Y43YGpnzljr0E8aj8G9Ku+oukzuhWkiWBkOuRGK:GL2O3YGpnzlFBj59zukihIpjcK

Score

10^/10

systembc trojan

Family

systembc

109.205.214.18:443

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

ssfsb.exe

pid process

1392 ssfsb.exe

pid	process
1392	ssfsb.exe

Drops file in Windows directory 2 IoCs

Processes:

84499558c48c4fdebac20cab68253aa7.exe

description	ioc	process
File created	C:\Windows\Tasks\ssfsb.job	84499558c48c4fdebac20cab68253aa7.exe
File opened for modification	C:\Windows\Tasks\ssfsb.job	84499558c48c4fdebac20cab68253aa7.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5056 2976 WerFault.exe 84499558c48c4fdebac20cab68253aa7.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

84499558c48c4fdebac20cab68253aa7.exe

pid process

2976 84499558c48c4fdebac20cab68253aa7.exe
2976 84499558c48c4fdebac20cab68253aa7.exe

pid	pid_target	process	target process
5056	2976	WerFault.exe	84499558c48c4fdebac20cab68253aa7.exe

pid	process
2976	84499558c48c4fdebac20cab68253aa7.exe
2976	84499558c48c4fdebac20cab68253aa7.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 960
2⤵
- Program crash
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2976 -ip 2976
1⤵
PID:3884

C:\ProgramData\xofjvbf\ssfsb.exe
C:\ProgramData\xofjvbf\ssfsb.exe start
1⤵
- Executes dropped EXE
PID:1392

C:\ProgramData\xofjvbf\ssfsb.exe
Filesize
228KB

MD5
84499558c48c4fdebac20cab68253aa7

SHA1
d4518c621d32ebc483a8f0761cf6ed0fe3c7b8ce

SHA256
ca958072c2483f5cfab83972b3e5a25a163eed2d0d6df7d310ddf200a6fec53c

SHA512
00ad7c29108eb787d0283bb6a6c2955ff3b4a64254d03767c1c21e8bf3a1e14149958c9de8f4fd2f6489972b4573b07abc18a3bc2e96cba5fe2d4852d204d65a

Download Submit
C:\ProgramData\xofjvbf\ssfsb.exe
Filesize
228KB

MD5
84499558c48c4fdebac20cab68253aa7

SHA1
d4518c621d32ebc483a8f0761cf6ed0fe3c7b8ce

SHA256
ca958072c2483f5cfab83972b3e5a25a163eed2d0d6df7d310ddf200a6fec53c

SHA512
00ad7c29108eb787d0283bb6a6c2955ff3b4a64254d03767c1c21e8bf3a1e14149958c9de8f4fd2f6489972b4573b07abc18a3bc2e96cba5fe2d4852d204d65a

Download Submit
memory/1392-149-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2976-134-0x00000000006C0000-0x00000000006C9000-memory.dmp

Filesize
36KB

Download
memory/2976-135-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download