systembc | 313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-07-2023 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

s64com.dll
Size

6.4MB
MD5

cb44d16ebac295a75245dce05a75997b
SHA1

101cc9e8df36e1e7061f449a84109d1d75e6f8ae
SHA256

313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355
SHA512

a21a09fe60dd4380fdb9fbbeee0e6f0c543a8182aa6b3be5e77306928222c90bdd27b6dc2a1f54f31a5ba3c0322914a36c009773f30f9b94c4246110254bbb4b
SSDEEP

196608:r/Ux5R45q2JoGqtQLHTE/+667kFiQwI99:Ai5q2yXtaU+6U7I

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

5.42.65.67:4298

localhost.exchange:4298

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2440 rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2440 rundll32.exe

flow	pid	process
2	2440	rundll32.exe

pid	process
2440	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\s64com.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-57-0x0000000077920000-0x0000000077922000-memory.dmp

Filesize
8KB

Download
memory/2440-55-0x000007FEF4F20000-0x000007FEF59A4000-memory.dmp

Filesize
10.5MB

Download
memory/2440-54-0x0000000077920000-0x0000000077922000-memory.dmp

Filesize
8KB

Download
memory/2440-60-0x0000000077770000-0x0000000077919000-memory.dmp

Filesize
1.7MB

Download
memory/2440-59-0x0000000077920000-0x0000000077922000-memory.dmp

Filesize
8KB

Download
memory/2440-61-0x0000000077930000-0x0000000077932000-memory.dmp

Filesize
8KB

Download
memory/2440-63-0x0000000077930000-0x0000000077932000-memory.dmp

Filesize
8KB

Download
memory/2440-65-0x0000000077930000-0x0000000077932000-memory.dmp

Filesize
8KB

Download
memory/2440-66-0x0000000077940000-0x0000000077942000-memory.dmp

Filesize
8KB

Download
memory/2440-68-0x0000000077940000-0x0000000077942000-memory.dmp

Filesize
8KB

Download
memory/2440-70-0x0000000077940000-0x0000000077942000-memory.dmp

Filesize
8KB

Download
memory/2440-71-0x0000000077950000-0x0000000077952000-memory.dmp

Filesize
8KB

Download
memory/2440-73-0x0000000077950000-0x0000000077952000-memory.dmp

Filesize
8KB

Download
memory/2440-75-0x0000000077950000-0x0000000077952000-memory.dmp

Filesize
8KB

Download
memory/2440-76-0x0000000077960000-0x0000000077962000-memory.dmp

Filesize
8KB

Download
memory/2440-78-0x0000000077960000-0x0000000077962000-memory.dmp

Filesize
8KB

Download
memory/2440-80-0x0000000077960000-0x0000000077962000-memory.dmp

Filesize
8KB

Download
memory/2440-83-0x000007FEFD660000-0x000007FEFD662000-memory.dmp

Filesize
8KB

Download
memory/2440-85-0x000007FEFD660000-0x000007FEFD662000-memory.dmp

Filesize
8KB

Download
memory/2440-88-0x000007FEFD670000-0x000007FEFD672000-memory.dmp

Filesize
8KB

Download
memory/2440-90-0x000007FEFD670000-0x000007FEFD672000-memory.dmp

Filesize
8KB

Download
memory/2440-91-0x000007FEF4F20000-0x000007FEF59A4000-memory.dmp

Filesize
10.5MB

Download
memory/2440-92-0x0000000077770000-0x0000000077919000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads