systembc | cfb1fd0adf528fcf14647cf3fcd85fb7e4fddd2167b36f9e8b2424b62453df28 | Triage

Analysis

max time kernel
142s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 15:28

Sharing

Report Analysis Logs

General

Target

0x0006000000015679-49.exe
Size

16KB
MD5

4f01c3d7439dde153ff0110a26e2a71c
SHA1

40d7203ad4e1fd40e13a56e6f747ee480740873c
SHA256

cfb1fd0adf528fcf14647cf3fcd85fb7e4fddd2167b36f9e8b2424b62453df28
SHA512

513d09b80e1ac80813bc691e71cdf5348478157350e43b9daed27741b7f5a7a16b2ae4d88ee9951395747c7f2a93ff0c1f2c3753a9e3bad2e2607767a1e3d28e
SSDEEP

384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

cobusabobus.cam:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 2 IoCs

pid	Process
4724	nvebi.exe
3604	nvebi.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\nvebi.job	0x0006000000015679-49.exe
File opened for modification	C:\Windows\Tasks\nvebi.job	0x0006000000015679-49.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
748	0x0006000000015679-49.exe
748	0x0006000000015679-49.exe

C:\Users\Admin\AppData\Local\Temp\0x0006000000015679-49.exe
"C:\Users\Admin\AppData\Local\Temp\0x0006000000015679-49.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:748

C:\ProgramData\kiohg\nvebi.exe
C:\ProgramData\kiohg\nvebi.exe start2
1⤵
- Executes dropped EXE
PID:4724

C:\ProgramData\kiohg\nvebi.exe
C:\ProgramData\kiohg\nvebi.exe start2
1⤵
- Executes dropped EXE
PID:3604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kiohg\nvebi.exe

Filesize
16KB

MD5
4f01c3d7439dde153ff0110a26e2a71c

SHA1
40d7203ad4e1fd40e13a56e6f747ee480740873c

SHA256
cfb1fd0adf528fcf14647cf3fcd85fb7e4fddd2167b36f9e8b2424b62453df28

SHA512
513d09b80e1ac80813bc691e71cdf5348478157350e43b9daed27741b7f5a7a16b2ae4d88ee9951395747c7f2a93ff0c1f2c3753a9e3bad2e2607767a1e3d28e

Download Submit