systembc | 922ceb1d012920ad840955075cde0d92829d179d67e7116ebb97b61214d1b537

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2023 05:39

Target

0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe
Size

275KB
MD5

218976414ca64c87d927e0e02e928228
SHA1

d7cfb79d350bb5b13ec78a8b34a9cc2f05eabf93
SHA256

0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae
SHA512

e52af220c6339722a0f520ba42646a18ec1911f7c4bfcf9043eae74c2e5f95a77bdd683010cf1a6378eac0e49312bb1a2e70ffa5e5082c1572a0a29454008af0
SSDEEP

6144:DpjrIOKLD/HU9SNqvkCGY0GG9dY5zbmIc+8aSVj2e:1jreLTHq6qvkCGY0GG9dubm5+8Vjz

Score

10^/10

systembc trojan

Family

systembc

45.147.231.86:4254

146.70.53.169:4254

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\wow64.job	0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe
File created	C:\Windows\Tasks\wow64.job	0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4260	4148	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe
"C:\Users\Admin\AppData\Local\Temp\0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe"
1⤵
- Drops file in Windows directory
PID:4148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 480
  2⤵
  - Program crash
  PID:4260

C:\Users\Admin\AppData\Local\Temp\0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe
C:\Users\Admin\AppData\Local\Temp\0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe start
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4148 -ip 4148
1⤵
PID:3204

memory/4148-1-0x0000000000A20000-0x0000000000B20000-memory.dmp

Filesize
1024KB

Download
memory/4148-2-0x00000000001C0000-0x00000000001C5000-memory.dmp

Filesize
20KB

Download
memory/4148-4-0x0000000000400000-0x0000000000847000-memory.dmp

Filesize
4.3MB

Download
memory/4148-7-0x0000000000A20000-0x0000000000B20000-memory.dmp

Filesize
1024KB

Download
memory/4148-8-0x00000000001C0000-0x00000000001C5000-memory.dmp

Filesize
20KB

Download