Overview

overview

10

Static

static

1

b63f57d948...54.dll

windows7-x64

10

b63f57d948...54.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    28s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    09-07-2023 19:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b63f57d948b00f885ce27af54.dll

  • Size

    3.4MB

  • MD5

    b63f57d948b00f885ce27af54503df3a

  • SHA1

    c74d0c64b4167b8da999a96fba52c3a75b00529d

  • SHA256

    22a094a2bdd1c3f865046f54b3cf3c958cf59f57f7a0ed9c0c31aadc8cf49ec4

  • SHA512

    be82579607ec9055416a1a5595fdd6bd13734a30ae55ac293772cb226553cd3033ec6fc8ba80b77a23716497f5adb72d676a17ead8a8ebeb66db01e5edf7ffe9

  • SSDEEP

    98304:a830UshgHzyAUUxfystLGUtR/UfBt14SUyDIzC4ODoBZNlhK:arhMyO6aUpac+C4KoBl0

Score
10/10
systembctrojan

Malware Config

Extracted

Family

systembc

C2

5.42.65.67:4298

localhost.exchange:4298

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • Blocklisted process makes network request 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b63f57d948b00f885ce27af54.dll,#1
    1⤵
    • Blocklisted process makes network request
    PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2324-54-0x000007FEF5880000-0x000007FEF5D93000-memory.dmp
    Filesize

    5.1MB

    Download