systembc | 7b13d5cea1797ed426be734ac146c7d07eccc743ab41ee2be7134f73a6905836

Analysis

max time kernel
81s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2023 13:00

Target

1332-55-0x000007FEF61C0000-0x000007FEF66F2000-memory.dll
Size

5.2MB
MD5

568a4056b2be640984ab8e3693b8605f
SHA1

619143881538ae925d4b3bbd36cada5581b4c8af
SHA256

7b13d5cea1797ed426be734ac146c7d07eccc743ab41ee2be7134f73a6905836
SHA512

8d908573d5863f0993e627cdf571b79e8df62d5dba32ee3352651fa4bab1ccde294f759cac0d6052818ea89e3deb422e06797f336f346d6cde54235ec50e2123
SSDEEP

98304:WjpVT7uv9amcCivg0pPb+/I+nuGBQ1ruWBW:WjruvoCiBpPK/DuUWBW

Score

10^/10

Family

systembc

5.42.65.67:4298

localhost.exchange:4298

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral2/memory/4988-133-0x00007FF94F7B0000-0x00007FF94FCE2000-memory.dmp	themida

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4652 4988 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4652	4988	WerFault.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1332-55-0x000007FEF61C0000-0x000007FEF66F2000-memory.dll,#1
1⤵
PID:4988

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4988 -s 240
2⤵
- Program crash
PID:4652

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 4988 -ip 4988
1⤵
PID:4772

memory/4988-133-0x00007FF94F7B0000-0x00007FF94FCE2000-memory.dmp

Filesize
5.2MB

Download