systembc | 11f88c287b501abb341631221d59ef63089baa83faecbf222c3ba618e5f49456

Analysis

max time kernel
203s
max time network
254s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
05-08-2023 03:54

Target

11f88c287b501abb341631221d59ef63089baa83faecbf222c3ba618e5f49456.dll
Size

6.4MB
MD5

48514490face0a58cd5ea063e7de28e0
SHA1

ca52f90d5d6995f68bde1daf3900b3854431a3dd
SHA256

11f88c287b501abb341631221d59ef63089baa83faecbf222c3ba618e5f49456
SHA512

d1fdc7b7420f03dc29b9cd447a1235c34dab75b10b977b0d7cc72b429001a79d588d57f5d91165c4aff349313f6d76016ef44899f50963d3d774a97bfdcf1a48
SSDEEP

196608:NZwmQb62Pk1t+w69MCaSuxu70XSUAFTNknuFkJ:TW62Pk1t+JJuI70CbHe

Score

10^/10

Family

systembc

5.42.65.67:4298

localhost.exchange:4298

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

1 1100 rundll32.exe

flow	pid	process
1	1100	rundll32.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/1100-119-0x00007FF943CD0000-0x00007FF9447E2000-memory.dmp	vmprotect
behavioral2/memory/1100-127-0x00007FF943CD0000-0x00007FF9447E2000-memory.dmp	vmprotect

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1100 rundll32.exe
1100 rundll32.exe
1100 rundll32.exe
1100 rundll32.exe

memory/1100-119-0x00007FF943CD0000-0x00007FF9447E2000-memory.dmp

Filesize
11.1MB

Download
memory/1100-120-0x00007FF95FD60000-0x00007FF95FD62000-memory.dmp

Filesize
8KB

Download
memory/1100-118-0x00007FF95FD50000-0x00007FF95FD52000-memory.dmp

Filesize
8KB

Download
memory/1100-121-0x00007FF95ECE0000-0x00007FF95ECE2000-memory.dmp

Filesize
8KB

Download
memory/1100-122-0x00007FF95ECF0000-0x00007FF95ECF2000-memory.dmp

Filesize
8KB

Download
memory/1100-123-0x00007FF95C460000-0x00007FF95C462000-memory.dmp

Filesize
8KB

Download
memory/1100-124-0x00007FF95C470000-0x00007FF95C472000-memory.dmp

Filesize
8KB

Download
memory/1100-126-0x00007FF95FD70000-0x00007FF95FD72000-memory.dmp

Filesize
8KB

Download
memory/1100-127-0x00007FF943CD0000-0x00007FF9447E2000-memory.dmp

Filesize
11.1MB

Download