systembc | 4dae3b84eeb5e36c144f9fad2f2b06d9e82381cda6b1f043033cf3644f339558

Analysis

max time kernel
142s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2023, 16:50

Target
4dae3b84eeb5e36c144f9fad2f2b06d9e82381cda6b1f043033cf3644f339558.dll
Size 1.6MB
Sample231205-vcbaksdb22
SHA256 4dae3b84eeb5e36c144f9fad2f2b06d9e82381cda6b1f043033cf3644f339558
MD5 509b68725e595b30fb2f38c8ea2cf9c4
SHA1 1aff17b87ff213c1a8f4c8cfe48782e636b6fb32
SHA512 dc7a8e6404c3b1e2600c16c66ed023e6e5f7010efa96fa2c4c5abf8fe4a8c4847abd133a1198d4bb12224c93d4ede1ef1dfe1c6c584749160e9beff2a1585389
SSDEEP 24576:ejhyCJxQWOSUua9BgsID7yByhWjqcRE4ff6ySznNvWGYbjWfExlpaheDtg3UUag7:GfzUua9h9ERznNeXHWfExzmPLnvh6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc trojan

Family

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Blocklisted process makes network request 1 IoCs

flow	pid	Process
65	3520	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3520	2992	rundll32.exe	17
PID 2992 wrote to memory of 3520	2992	rundll32.exe	17
PID 2992 wrote to memory of 3520	2992	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dae3b84eeb5e36c144f9fad2f2b06d9e82381cda6b1f043033cf3644f339558.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dae3b84eeb5e36c144f9fad2f2b06d9e82381cda6b1f043033cf3644f339558.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3520

memory/3520-0-0x0000000002E80000-0x0000000002F89000-memory.dmp

Download

memory/3520-1-0x0000000002D30000-0x0000000002D37000-memory.dmp

Download