systembc | 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a

Resubmissions

16-05-2022 16:24

max time kernel
143s
max time network
146s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
14-04-2024 14:32

Target

5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
Size

222KB
MD5

72cfa33b978294103889481feca472f2
SHA1

0615eb31fd67345b9fa0d57d12a3bcb363152abe
SHA256

5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a
SHA512

d1de5fee23b7a858ec62b849cd8a41cf896ab8b6df4836c65ba36942c1d1727b36832d45713a578c93e8a0b8650bf55923568637d91bb9b2196257a2ae015559
SSDEEP

3072:m04yjyyUD1HncBNyBNp5oEug4OkyJAQF1G8Xrrw+cC+lJDJEQkjvuMM:SR1HUUPCEZ4OkyJ9rrw+cZTuZSMM

Score

10^/10

systembc trojan

Family

systembc

fanstat18.club:4044

dexblog90.club:4044

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 2 IoCs

Processes:

gsrhbad.exegsrhbad.exe

pid process

4804 gsrhbad.exe
4364 gsrhbad.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 api.ipify.org
8 api.ipify.org

pid	process
4804	gsrhbad.exe
4364	gsrhbad.exe

flow	ioc
7	api.ipify.org
8	api.ipify.org

Drops file in Windows directory 2 IoCs

Processes:

5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe

description	ioc	process
File created	C:\Windows\Tasks\gsrhbad.job	5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
File opened for modification	C:\Windows\Tasks\gsrhbad.job	5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe

pid	process
2020	5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
2020	5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe

C:\ProgramData\lsrihx\gsrhbad.exe
C:\ProgramData\lsrihx\gsrhbad.exe start2
1⤵
- Executes dropped EXE
PID:4804

C:\ProgramData\lsrihx\gsrhbad.exe
C:\ProgramData\lsrihx\gsrhbad.exe start2
1⤵
- Executes dropped EXE
PID:4364

C:\ProgramData\lsrihx\gsrhbad.exe
Filesize
222KB

MD5
72cfa33b978294103889481feca472f2

SHA1
0615eb31fd67345b9fa0d57d12a3bcb363152abe

SHA256
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a

SHA512
d1de5fee23b7a858ec62b849cd8a41cf896ab8b6df4836c65ba36942c1d1727b36832d45713a578c93e8a0b8650bf55923568637d91bb9b2196257a2ae015559

Download Submit
memory/2020-1-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2020-2-0x0000000000530000-0x0000000000539000-memory.dmp

Filesize
36KB

Download
memory/2020-3-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2020-14-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/4364-31-0x0000000000700000-0x0000000000800000-memory.dmp

Filesize
1024KB

Download
memory/4364-32-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/4364-35-0x0000000000700000-0x0000000000800000-memory.dmp

Filesize
1024KB

Download
memory/4804-11-0x00000000006D0000-0x00000000007D0000-memory.dmp

Filesize
1024KB

Download
memory/4804-12-0x0000000000610000-0x0000000000619000-memory.dmp

Filesize
36KB

Download
memory/4804-13-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/4804-18-0x00000000006D0000-0x00000000007D0000-memory.dmp

Filesize
1024KB

Download