systembc | 046e029c41ac8987649a05e98db75a462e6d42f5f32e871f907036d23ec2d701

Analysis

max time kernel
147s
max time network
268s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16/04/2024, 11:08

Target

046e029c41ac8987649a05e98db75a462e6d42f5f32e871f907036d23ec2d701.exe
Size

212KB
MD5

3645d634e5976620737eaffe304d30a7
SHA1

6b8f47c29a2710a5dee91f61095b71cd3bb65660
SHA256

046e029c41ac8987649a05e98db75a462e6d42f5f32e871f907036d23ec2d701
SHA512

00014b0a0c892718ea66630137639305da6294636598a90dcafcb7d71869bcd5912c8ee531d9265682321859da8ce4466da8a41347ecab069f182b4ae421862d
SSDEEP

6144:YDnLgI91y1UkT57iJz/DpURWPSvHuUiYphu1U:cnLh9yn52rpUR5vHuRYpM+

Score

10^/10

systembc trojan upx

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/3028-3-0x0000000000400000-0x00000000045F0000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3548	3028	WerFault.exe	77

C:\Users\Admin\AppData\Local\Temp\046e029c41ac8987649a05e98db75a462e6d42f5f32e871f907036d23ec2d701.exe
"C:\Users\Admin\AppData\Local\Temp\046e029c41ac8987649a05e98db75a462e6d42f5f32e871f907036d23ec2d701.exe"
1⤵
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 248
  2⤵
  - Program crash
  PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3028 -ip 3028
1⤵
PID:336

memory/3028-1-0x0000000004850000-0x0000000004950000-memory.dmp

Filesize
1024KB

Download
memory/3028-2-0x00000000046E0000-0x00000000046E9000-memory.dmp

Filesize
36KB

Download
memory/3028-3-0x0000000000400000-0x00000000045F0000-memory.dmp

Filesize
65.9MB

Download