systembc | a216650a36498389a10434af63324705ac991f815bae1ba65d9ecf31f71862de

Analysis

max time kernel
203s
max time network
206s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01-08-2023 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a216650a36498389a10434af63324705ac991f815bae1ba65d9ecf31f71862de.dll
Size

6.2MB
MD5

374d8e8089ecf5f1a161514d1b346432
SHA1

cf3b7d0b7a80a64a5e5a02cf0ea1b588ca0ce0d0
SHA256

a216650a36498389a10434af63324705ac991f815bae1ba65d9ecf31f71862de
SHA512

085c681ac01da5fd5dbc922e7039b41bf6c0b0dc0446ac7e8e5ba904c187c32b0b7e081206c50cbe88b1af303ac2215c7672af3ec1a46eb73bcd576b003f628c
SSDEEP

98304:BtEdRaCU9BlAa/WtuNABPUM6fgGYa3+HQ6JF4VbFofo4eM5YavbJ9nEv:BtEL8WXtB2kUw14bafo4B5YaTJ9nEv

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

5.42.65.67:4298

localhost.exchange:4298

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 2228 rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2228 rundll32.exe

flow	pid	process
2	2228	rundll32.exe

pid	process
2228	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a216650a36498389a10434af63324705ac991f815bae1ba65d9ecf31f71862de.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-54-0x0000000077C70000-0x0000000077C72000-memory.dmp

Filesize
8KB

Download
memory/2228-56-0x000007FEF5270000-0x000007FEF5CF9000-memory.dmp

Filesize
10.5MB

Download
memory/2228-57-0x0000000077C70000-0x0000000077C72000-memory.dmp

Filesize
8KB

Download
memory/2228-59-0x000007FEF5270000-0x000007FEF5CF9000-memory.dmp

Filesize
10.5MB

Download
memory/2228-61-0x0000000077C70000-0x0000000077C72000-memory.dmp

Filesize
8KB

Download
memory/2228-63-0x0000000077AC0000-0x0000000077C69000-memory.dmp

Filesize
1.7MB

Download
memory/2228-62-0x0000000077C80000-0x0000000077C82000-memory.dmp

Filesize
8KB

Download
memory/2228-65-0x0000000077C80000-0x0000000077C82000-memory.dmp

Filesize
8KB

Download
memory/2228-67-0x0000000077C80000-0x0000000077C82000-memory.dmp

Filesize
8KB

Download
memory/2228-68-0x0000000077C90000-0x0000000077C92000-memory.dmp

Filesize
8KB

Download
memory/2228-70-0x0000000077C90000-0x0000000077C92000-memory.dmp

Filesize
8KB

Download
memory/2228-72-0x0000000077C90000-0x0000000077C92000-memory.dmp

Filesize
8KB

Download
memory/2228-73-0x0000000077CA0000-0x0000000077CA2000-memory.dmp

Filesize
8KB

Download
memory/2228-75-0x0000000077CA0000-0x0000000077CA2000-memory.dmp

Filesize
8KB

Download
memory/2228-77-0x0000000077CA0000-0x0000000077CA2000-memory.dmp

Filesize
8KB

Download
memory/2228-78-0x0000000077CB0000-0x0000000077CB2000-memory.dmp

Filesize
8KB

Download
memory/2228-80-0x0000000077CB0000-0x0000000077CB2000-memory.dmp

Filesize
8KB

Download
memory/2228-82-0x0000000077CB0000-0x0000000077CB2000-memory.dmp

Filesize
8KB

Download
memory/2228-85-0x000007FEFD990000-0x000007FEFD992000-memory.dmp

Filesize
8KB

Download
memory/2228-87-0x000007FEFD990000-0x000007FEFD992000-memory.dmp

Filesize
8KB

Download
memory/2228-90-0x000007FEFD9A0000-0x000007FEFD9A2000-memory.dmp

Filesize
8KB

Download
memory/2228-92-0x000007FEFD9A0000-0x000007FEFD9A2000-memory.dmp

Filesize
8KB

Download
memory/2228-94-0x0000000077AC0000-0x0000000077C69000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads