systembc | fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2023 23:58

Target

i.exe
Size

218KB
MD5

cdc67700f25eaed1417264c4bdec03d3
SHA1

56639e9414e6ee8394d940d62778475ddf071290
SHA256

fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512

a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
SSDEEP

3072:ErayULJ3h3C59R+rVZxzAskAGbhAzT69ohOP+L+h7b/MxuCwLgNHCDml:E2yUL1JC4fxUspGbhgT62hO2LC2HCa

Score

10^/10

systembc trojan

Family

systembc

109.205.214.18:443

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

xfbxb.exe

pid process

1144 xfbxb.exe
Drops file in Windows directory 2 IoCs

Processes:

i.exe

description ioc process

File created C:\Windows\Tasks\xfbxb.job i.exe
File opened for modification C:\Windows\Tasks\xfbxb.job i.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4032 4608 WerFault.exe i.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

i.exe

pid process

4608 i.exe
4608 i.exe

pid	process
1144	xfbxb.exe

description	ioc	process
File created	C:\Windows\Tasks\xfbxb.job	i.exe
File opened for modification	C:\Windows\Tasks\xfbxb.job	i.exe

pid	pid_target	process	target process
4032	4608	WerFault.exe	i.exe

pid	process
4608	i.exe
4608	i.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 956
2⤵
- Program crash
PID:4032

C:\ProgramData\njwkx\xfbxb.exe
C:\ProgramData\njwkx\xfbxb.exe start
1⤵
- Executes dropped EXE
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4608 -ip 4608
1⤵
PID:2500

C:\ProgramData\njwkx\xfbxb.exe

Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
C:\ProgramData\njwkx\xfbxb.exe

Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
memory/1144-143-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4608-134-0x00000000006F0000-0x00000000006F9000-memory.dmp

Filesize
36KB

Download
memory/4608-135-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4608-154-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download