systembc | 0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2023 07:24

Target

0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b.exe
Size

178KB
MD5

8832f51c590d70cd12116f8f330cc31c
SHA1

f4fd64ddf8dbf0c079485b84e463849c158b2b29
SHA256

0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b
SHA512

7bbf94d5b232d7b79911f55efbf5fbb6260861914e0345525d930756169fe263ea0923772166d1199985bf1ad8a43bc9a372a4c9e1abfb9604cec28ee3f5f799
SSDEEP

3072:ljLeiNX7DF31RzcUPwpmAoNExCRSR3aFxc:l6eX7DFbPkIpPc

Score

10^/10

systembc trojan

Family

systembc

62.182.82.33:1488

usaf.army:1488

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b.exe
File opened for modification	C:\Windows\Tasks\wow64.job	0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1548 640 WerFault.exe 0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b.exe

pid	pid_target	process	target process
1548	640	WerFault.exe	0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b.exe

C:\Users\Admin\AppData\Local\Temp\0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b.exe
"C:\Users\Admin\AppData\Local\Temp\0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b.exe"
1⤵
- Drops file in Windows directory
PID:640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 944
  2⤵
  - Program crash
  PID:1548

C:\Users\Admin\AppData\Local\Temp\0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b.exe
C:\Users\Admin\AppData\Local\Temp\0afe06f881b9258506cfe831a2b489859c60a08747beba00461cd99c3b0b9f0b.exe start
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 640 -ip 640
1⤵
PID:776

memory/640-134-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/640-135-0x0000000000560000-0x0000000000565000-memory.dmp

Filesize
20KB

Download
memory/640-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/640-143-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/640-157-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1328-140-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download
memory/1328-142-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1328-141-0x00000000004C0000-0x00000000004C5000-memory.dmp

Filesize
20KB

Download
memory/1328-146-0x0000000000690000-0x0000000000790000-memory.dmp

Filesize
1024KB

Download