systembc | 31cdb1024e6010e5a59c0fc509432e6928c4eaf1a42c82e9fbd33e9aac2c552c | Triage

Resubmissions

10-04-2024 03:10

240410-dpckqsfg9s 10

10-04-2024 03:10

240410-dpby7sce45 10

10-04-2024 03:10

240410-dpbcnsfg8y 10

10-04-2024 03:10

240410-dpa2xafg8x 10

22-12-2023 13:30

231222-qrz52abfd4 10

Analysis

max time kernel
206s
max time network
277s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
10-04-2024 03:10

Sharing

Report Analysis Logs

General

Target

a41982f4915a70f246b0d6109280f39b.exe
Size

209KB
MD5

a41982f4915a70f246b0d6109280f39b
SHA1

a256130c4872a7860a95dbabfd6e8b5ea60e83aa
SHA256

31cdb1024e6010e5a59c0fc509432e6928c4eaf1a42c82e9fbd33e9aac2c552c
SHA512

890395bc017590ccf80e08b0d542c7c556c6d30cb7bb1902acc525745bcb225467fe0c9c213836eca0f577058334bfc90e6a767cbcb9e9ea5bff870ba006032a
SSDEEP

6144:YDnLgI91y1UkT57iJz/DpURWPSvHuUiYphu1Us:cnLh9yn52rpUR5vHuRYpM+s

Score

10^/10

systembc trojan upx

Malware Config

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/4976-3-0x0000000000400000-0x00000000045F0000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4060	4976	WerFault.exe	76

C:\Users\Admin\AppData\Local\Temp\a41982f4915a70f246b0d6109280f39b.exe
"C:\Users\Admin\AppData\Local\Temp\a41982f4915a70f246b0d6109280f39b.exe"
1⤵
PID:4976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 240
  2⤵
  - Program crash
  PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4976 -ip 4976
1⤵
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4976-1-0x00000000048B0000-0x00000000049B0000-memory.dmp

Filesize
1024KB

Download
memory/4976-2-0x00000000047B0000-0x00000000047B9000-memory.dmp

Filesize
36KB

Download
memory/4976-3-0x0000000000400000-0x00000000045F0000-memory.dmp

Filesize
65.9MB

Download