systembc | 36a101b5a13436dd67e2b33c2abbae7cdd86a7ed951185a1914c12685339ad74

Analysis

Target
c96012bf82cc15058dd53887b068bbd8.exe
Size 267KB
Sample201214-72qzpyctx2
SHA256 36a101b5a13436dd67e2b33c2abbae7cdd86a7ed951185a1914c12685339ad74
MD5 c96012bf82cc15058dd53887b068bbd8
SHA1 3502862e8ef4edd8ff5a427849d8c9f38e45160d
SHA512 315495dcba5d3624ce716ea534a1f74d7256f176b06a7dac006b64d8019ce4dc9ae67857466d1a838ab8bd02ad70fb14b4e425ab29e5e00c6ab8b19a0d94e56a
MD5 SHA1 SHA512

Score

10^/10

systembc trojan

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 1 IoCs

pid	Process
1368	ldpke.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ldpke.job	c96012bf82cc15058dd53887b068bbd8.exe
File opened for modification	C:\Windows\Tasks\ldpke.job	c96012bf82cc15058dd53887b068bbd8.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1208	c96012bf82cc15058dd53887b068bbd8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1368	1700	taskeng.exe	30
PID 1700 wrote to memory of 1368	1700	taskeng.exe	30
PID 1700 wrote to memory of 1368	1700	taskeng.exe	30
PID 1700 wrote to memory of 1368	1700	taskeng.exe	30

C:\Windows\system32\taskeng.exe
taskeng.exe {B2A4C25F-7622-4523-A807-5386A0BC1BD3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\ProgramData\ubxwedc\ldpke.exe
  C:\ProgramData\ubxwedc\ldpke.exe start
  2⤵
  - Executes dropped EXE
  PID:1368

memory/1208-2-0x0000000000790000-0x00000000007A1000-memory.dmp

Download