systembc | 91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1da22324541e3de280c13160289986a.exe
Size

444KB
MD5

b1da22324541e3de280c13160289986a
SHA1

71786d8fa931c49e942bfe428aade8a15231852b
SHA256

91735a2a578ca710a1f2e09985ba20079971ee87aa45bfb4b18f4f74a43ce08f
SHA512

a04c5c9f40a6f42c659a8b5056e2d89f0d96175cd0aa76fa875a666abc91dfd52beec4bef471351ee070233b2a7ca97395e1981fb1dbf31da7ccbcdad251e513
SSDEEP

6144:Yv4pofbY8quKmfO0TaCaNNqB13O2/b8spTqC5hTxQ/u8JjFWG2:Yv4p7xPm2B9KfTxUu8JjFg

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

mxstat215dm.xyz:4044

mxstex725dm.xyz:4044

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3628 set thread context of 3616	3628	b1da22324541e3de280c13160289986a.exe	83

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3628	b1da22324541e3de280c13160289986a.exe
3628	b1da22324541e3de280c13160289986a.exe
3628	b1da22324541e3de280c13160289986a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3628	b1da22324541e3de280c13160289986a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3616	3628	b1da22324541e3de280c13160289986a.exe	83
PID 3628 wrote to memory of 3616	3628	b1da22324541e3de280c13160289986a.exe	83
PID 3628 wrote to memory of 3616	3628	b1da22324541e3de280c13160289986a.exe	83
PID 3628 wrote to memory of 3616	3628	b1da22324541e3de280c13160289986a.exe	83
PID 3628 wrote to memory of 3616	3628	b1da22324541e3de280c13160289986a.exe	83
PID 3628 wrote to memory of 3616	3628	b1da22324541e3de280c13160289986a.exe	83
PID 3628 wrote to memory of 3616	3628	b1da22324541e3de280c13160289986a.exe	83
PID 3628 wrote to memory of 3616	3628	b1da22324541e3de280c13160289986a.exe	83
PID 3628 wrote to memory of 3616	3628	b1da22324541e3de280c13160289986a.exe	83

C:\Users\Admin\AppData\Local\Temp\b1da22324541e3de280c13160289986a.exe
"C:\Users\Admin\AppData\Local\Temp\b1da22324541e3de280c13160289986a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Users\Admin\AppData\Local\Temp\b1da22324541e3de280c13160289986a.exe
  "C:\Users\Admin\AppData\Local\Temp\b1da22324541e3de280c13160289986a.exe"
  2⤵
  PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3616-14-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3616-16-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3616-15-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3628-8-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/3628-10-0x00000000093D0000-0x00000000093D6000-memory.dmp

Filesize
24KB

Download
memory/3628-5-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/3628-6-0x0000000005870000-0x000000000587A000-memory.dmp

Filesize
40KB

Download
memory/3628-7-0x00000000090D0000-0x0000000009112000-memory.dmp

Filesize
264KB

Download
memory/3628-0-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/3628-9-0x0000000009280000-0x000000000929A000-memory.dmp

Filesize
104KB

Download
memory/3628-4-0x0000000005960000-0x00000000059FC000-memory.dmp

Filesize
624KB

Download
memory/3628-11-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/3628-12-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/3628-13-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/3628-3-0x00000000058C0000-0x0000000005952000-memory.dmp

Filesize
584KB

Download
memory/3628-2-0x0000000005DD0000-0x0000000006374000-memory.dmp

Filesize
5.6MB

Download
memory/3628-1-0x0000000000A40000-0x0000000000AB6000-memory.dmp

Filesize
472KB

Download
memory/3628-18-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download