systembc | 313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355

Analysis

max time kernel
121s
max time network
256s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-07-2023 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355.dll
Size

6.4MB
MD5

cb44d16ebac295a75245dce05a75997b
SHA1

101cc9e8df36e1e7061f449a84109d1d75e6f8ae
SHA256

313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355
SHA512

a21a09fe60dd4380fdb9fbbeee0e6f0c543a8182aa6b3be5e77306928222c90bdd27b6dc2a1f54f31a5ba3c0322914a36c009773f30f9b94c4246110254bbb4b
SSDEEP

196608:r/Ux5R45q2JoGqtQLHTE/+667kFiQwI99:Ai5q2yXtaU+6U7I

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

5.42.65.67:4298

localhost.exchange:4298

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 3028 rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

3028 rundll32.exe

flow	pid	process
2	3028	rundll32.exe

pid	process
3028	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-53-0x0000000077390000-0x0000000077392000-memory.dmp

Filesize
8KB

Download
memory/3028-55-0x000007FEF4990000-0x000007FEF5414000-memory.dmp

Filesize
10.5MB

Download
memory/3028-56-0x0000000077390000-0x0000000077392000-memory.dmp

Filesize
8KB

Download
memory/3028-59-0x00000000771E0000-0x0000000077389000-memory.dmp

Filesize
1.7MB

Download
memory/3028-58-0x0000000077390000-0x0000000077392000-memory.dmp

Filesize
8KB

Download
memory/3028-60-0x00000000773A0000-0x00000000773A2000-memory.dmp

Filesize
8KB

Download
memory/3028-62-0x00000000773A0000-0x00000000773A2000-memory.dmp

Filesize
8KB

Download
memory/3028-64-0x00000000773A0000-0x00000000773A2000-memory.dmp

Filesize
8KB

Download
memory/3028-65-0x00000000773B0000-0x00000000773B2000-memory.dmp

Filesize
8KB

Download
memory/3028-67-0x00000000773B0000-0x00000000773B2000-memory.dmp

Filesize
8KB

Download
memory/3028-69-0x00000000773B0000-0x00000000773B2000-memory.dmp

Filesize
8KB

Download
memory/3028-70-0x00000000773C0000-0x00000000773C2000-memory.dmp

Filesize
8KB

Download
memory/3028-72-0x00000000773C0000-0x00000000773C2000-memory.dmp

Filesize
8KB

Download
memory/3028-74-0x00000000773C0000-0x00000000773C2000-memory.dmp

Filesize
8KB

Download
memory/3028-75-0x00000000773D0000-0x00000000773D2000-memory.dmp

Filesize
8KB

Download
memory/3028-77-0x00000000773D0000-0x00000000773D2000-memory.dmp

Filesize
8KB

Download
memory/3028-79-0x00000000773D0000-0x00000000773D2000-memory.dmp

Filesize
8KB

Download
memory/3028-82-0x000007FEFD1B0000-0x000007FEFD1B2000-memory.dmp

Filesize
8KB

Download
memory/3028-84-0x000007FEFD1B0000-0x000007FEFD1B2000-memory.dmp

Filesize
8KB

Download
memory/3028-87-0x000007FEFD1C0000-0x000007FEFD1C2000-memory.dmp

Filesize
8KB

Download
memory/3028-89-0x000007FEFD1C0000-0x000007FEFD1C2000-memory.dmp

Filesize
8KB

Download
memory/3028-90-0x000007FEF4990000-0x000007FEF5414000-memory.dmp

Filesize
10.5MB

Download
memory/3028-91-0x00000000771E0000-0x0000000077389000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads