systembc | 4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2024 13:07

Target

4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a.exe
Size

178KB
MD5

705796f3b9bd73f9a9a8a07c9f10b909
SHA1

93cf40f95ab91a0e33b405c0c49025dab7ceb496
SHA256

4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a
SHA512

4ce401041bdc5086345b856ac3f4baa804652cb6c14a7f84ae0cc1323783c2f54d8498aa9a1b72df0a3d86aa752f43873d4f9afc85b1544285e8a1f7ed53ae42
SSDEEP

3072:+ob0P2fTvOS1eSauhB8zfGci1+rbjb4Ke:eOLOS13SfGc3Hjf

Score

10^/10

systembc trojan

Family

systembc

95.179.161.101:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\wow64.job	4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a.exe
File created	C:\Windows\Tasks\wow64.job	4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3116 4276 WerFault.exe 4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a.exe

pid	pid_target	process	target process
3116	4276	WerFault.exe	4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a.exe

C:\Users\Admin\AppData\Local\Temp\4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a.exe
"C:\Users\Admin\AppData\Local\Temp\4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a.exe"
1⤵
- Drops file in Windows directory
PID:4276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 480
  2⤵
  - Program crash
  PID:3116

C:\Users\Admin\AppData\Local\Temp\4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a.exe
C:\Users\Admin\AppData\Local\Temp\4aed141bc47c4bdf1779182984a43dedb5b9e0f2ef220e29154028ad5f8ea55a.exe start
1⤵
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4276 -ip 4276
1⤵
PID:1572

memory/3216-7-0x0000000000400000-0x00000000008F7000-memory.dmp

Filesize
5.0MB

Download
memory/4276-2-0x0000000000A40000-0x0000000000A45000-memory.dmp

Filesize
20KB

Download
memory/4276-1-0x0000000000940000-0x0000000000A40000-memory.dmp

Filesize
1024KB

Download
memory/4276-3-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4276-8-0x0000000000400000-0x00000000008F7000-memory.dmp

Filesize
5.0MB

Download
memory/4276-12-0x0000000000A40000-0x0000000000A45000-memory.dmp

Filesize
20KB

Download
memory/4276-11-0x0000000000940000-0x0000000000A40000-memory.dmp

Filesize
1024KB

Download