systembc | fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2023 23:58

Target

i.exe
Size

218KB
MD5

cdc67700f25eaed1417264c4bdec03d3
SHA1

56639e9414e6ee8394d940d62778475ddf071290
SHA256

fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512

a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
SSDEEP

3072:ErayULJ3h3C59R+rVZxzAskAGbhAzT69ohOP+L+h7b/MxuCwLgNHCDml:E2yUL1JC4fxUspGbhgT62hO2LC2HCa

Score

10^/10

systembc trojan

Family

systembc

109.205.214.18:443

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

rdkhbmg.exe

pid process

3860 rdkhbmg.exe
Drops file in Windows directory 2 IoCs

Processes:

i.exe

description ioc process

File created C:\Windows\Tasks\rdkhbmg.job i.exe
File opened for modification C:\Windows\Tasks\rdkhbmg.job i.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2776 3668 WerFault.exe i.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

i.exe

pid process

3668 i.exe
3668 i.exe

pid	process
3860	rdkhbmg.exe

description	ioc	process
File created	C:\Windows\Tasks\rdkhbmg.job	i.exe
File opened for modification	C:\Windows\Tasks\rdkhbmg.job	i.exe

pid	pid_target	process	target process
2776	3668	WerFault.exe	i.exe

pid	process
3668	i.exe
3668	i.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 948
2⤵
- Program crash
PID:2776

C:\ProgramData\vojbupk\rdkhbmg.exe
C:\ProgramData\vojbupk\rdkhbmg.exe start
1⤵
- Executes dropped EXE
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3668 -ip 3668
1⤵
PID:656

C:\ProgramData\vojbupk\rdkhbmg.exe
Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
C:\ProgramData\vojbupk\rdkhbmg.exe
Filesize
218KB

MD5
cdc67700f25eaed1417264c4bdec03d3

SHA1
56639e9414e6ee8394d940d62778475ddf071290

SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100

SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038

Download Submit
memory/3668-134-0x00000000005A0000-0x00000000005A9000-memory.dmp

Filesize
36KB

Download
memory/3668-135-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3668-137-0x00000000005A0000-0x00000000005A9000-memory.dmp

Filesize
36KB

Download
memory/3668-155-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3860-144-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download