systembc | 69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6

Analysis

Target

69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
Size

137KB
MD5

d5927b50fee01b5fc563ece542455e23
SHA1

15c86056e1c53a9aad940d29c614e22cfde541d1
SHA256

69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6
SHA512

cb08f4a454686612b33a5f1dc62ce00f4209738b8ddcdb0da867871cf341cbef2937ba3913a8cc1a0643b079905e7c3c4cb75e4ea1f264acf51874f8261ea2da

Score

10^/10

systembc trojan

Family

systembc

178.20.41.149:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
File opened for modification	C:\Windows\Tasks\wow64.job	69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1792 wrote to memory of 736	1792	taskeng.exe	69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
PID 1792 wrote to memory of 736	1792	taskeng.exe	69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
PID 1792 wrote to memory of 736	1792	taskeng.exe	69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
PID 1792 wrote to memory of 736	1792	taskeng.exe	69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe

C:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
"C:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe"
1⤵
- Drops file in Windows directory
PID:1832

C:\Windows\system32\taskeng.exe
taskeng.exe {D1ACFE4B-994E-4721-ACC5-67A32458FF9A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
  C:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe start
  2⤵
  PID:736

memory/736-6-0x0000000000000000-mapping.dmp

Download
memory/736-7-0x0000000002E20000-0x0000000002E31000-memory.dmp

Filesize
68KB

Download
memory/1832-2-0x0000000002C90000-0x0000000002CA1000-memory.dmp

Filesize
68KB

Download
memory/1832-3-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/1832-4-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1832-5-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download