systembc | 91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1da22324541e3de280c13160289986a.exe
Size

444KB
MD5

b1da22324541e3de280c13160289986a
SHA1

71786d8fa931c49e942bfe428aade8a15231852b
SHA256

91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f
SHA512

a04c5c9f40a6f42c659a8b5056e2d89f0d96175cd0aa76fa875a666abc91dfd52beec4bef471351ee070233b2a7ca97395e1981fb1dbf31da7ccbcdad251e513
SSDEEP

6144:Yv4pofbY8quKmfO0TaCaNNqB13O2/b8spTqC5hTxQ/u8JjFWG2:Yv4p7xPm2B9KfTxUu8JjFg

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

mxstat215dm.xyz:4044

mxstex725dm.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 2728	2296	b1da22324541e3de280c13160289986a.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2296	b1da22324541e3de280c13160289986a.exe
2296	b1da22324541e3de280c13160289986a.exe
2296	b1da22324541e3de280c13160289986a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	b1da22324541e3de280c13160289986a.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2728	2296	b1da22324541e3de280c13160289986a.exe	28
PID 2296 wrote to memory of 2728	2296	b1da22324541e3de280c13160289986a.exe	28
PID 2296 wrote to memory of 2728	2296	b1da22324541e3de280c13160289986a.exe	28
PID 2296 wrote to memory of 2728	2296	b1da22324541e3de280c13160289986a.exe	28
PID 2296 wrote to memory of 2728	2296	b1da22324541e3de280c13160289986a.exe	28
PID 2296 wrote to memory of 2728	2296	b1da22324541e3de280c13160289986a.exe	28
PID 2296 wrote to memory of 2728	2296	b1da22324541e3de280c13160289986a.exe	28
PID 2296 wrote to memory of 2728	2296	b1da22324541e3de280c13160289986a.exe	28
PID 2296 wrote to memory of 2728	2296	b1da22324541e3de280c13160289986a.exe	28
PID 2296 wrote to memory of 2728	2296	b1da22324541e3de280c13160289986a.exe	28

C:\Users\Admin\AppData\Local\Temp\b1da22324541e3de280c13160289986a.exe
"C:\Users\Admin\AppData\Local\Temp\b1da22324541e3de280c13160289986a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\b1da22324541e3de280c13160289986a.exe
  "C:\Users\Admin\AppData\Local\Temp\b1da22324541e3de280c13160289986a.exe"
  2⤵
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-21-0x0000000000300000-0x0000000000340000-memory.dmp

Filesize
256KB

Download
memory/2296-19-0x0000000074460000-0x0000000074B4E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-2-0x0000000000300000-0x0000000000340000-memory.dmp

Filesize
256KB

Download
memory/2296-3-0x0000000002020000-0x0000000002062000-memory.dmp

Filesize
264KB

Download
memory/2296-4-0x0000000000300000-0x0000000000340000-memory.dmp

Filesize
256KB

Download
memory/2296-5-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/2296-6-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2296-0-0x0000000000340000-0x00000000003B6000-memory.dmp

Filesize
472KB

Download
memory/2296-24-0x0000000074460000-0x0000000074B4E000-memory.dmp

Filesize
6.9MB

Download
memory/2296-20-0x0000000000300000-0x0000000000340000-memory.dmp

Filesize
256KB

Download
memory/2296-1-0x0000000074460000-0x0000000074B4E000-memory.dmp

Filesize
6.9MB

Download
memory/2728-15-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2728-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2728-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2728-25-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2728-13-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2728-22-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2728-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2728-27-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2728-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download