systembc | e90fa8b16a3e943baf7882ce978b4903c3012be94370e99eb0560bb8e970d682

General

Target

5350c1492b2359b71a31ba103cc19b4f.exe
Size

886KB
MD5

5350c1492b2359b71a31ba103cc19b4f
SHA1

67b81cec1269523057aac6db028b33955bffc735
SHA256

e90fa8b16a3e943baf7882ce978b4903c3012be94370e99eb0560bb8e970d682
SHA512

6d0c70987524b698bf7e8cb78cfa247078810938535ff569dd9691ed6d5e8fbea703bf62180e07e624fda13c732db226d3f2231c48e3c698e5338cfb5f253f80

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

88.198.147.80:4174

78.47.64.46:4174

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

vcdbbg.exevcdbbg.exe

pid process

632 vcdbbg.exe
1160 vcdbbg.exe
Deletes itself 1 IoCs

Processes:

vcdbbg.exe

pid process

632 vcdbbg.exe

pid	process
632	vcdbbg.exe
1160	vcdbbg.exe

pid	process
632	vcdbbg.exe

Drops file in Windows directory 5 IoCs

Processes:

5350c1492b2359b71a31ba103cc19b4f.exe5350c1492b2359b71a31ba103cc19b4f.exevcdbbg.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	5350c1492b2359b71a31ba103cc19b4f.exe
File opened for modification	C:\Windows\Tasks\wow64.job	5350c1492b2359b71a31ba103cc19b4f.exe
File created	C:\Windows\Tasks\bqusmkbchihvxrpjhbx.job	5350c1492b2359b71a31ba103cc19b4f.exe
File created	C:\Windows\Tasks\wow64.job	vcdbbg.exe
File opened for modification	C:\Windows\Tasks\wow64.job	vcdbbg.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1224 wrote to memory of 1300	1224	taskeng.exe	5350c1492b2359b71a31ba103cc19b4f.exe
PID 1224 wrote to memory of 1300	1224	taskeng.exe	5350c1492b2359b71a31ba103cc19b4f.exe
PID 1224 wrote to memory of 1300	1224	taskeng.exe	5350c1492b2359b71a31ba103cc19b4f.exe
PID 1224 wrote to memory of 1300	1224	taskeng.exe	5350c1492b2359b71a31ba103cc19b4f.exe
PID 1224 wrote to memory of 632	1224	taskeng.exe	vcdbbg.exe
PID 1224 wrote to memory of 632	1224	taskeng.exe	vcdbbg.exe
PID 1224 wrote to memory of 632	1224	taskeng.exe	vcdbbg.exe
PID 1224 wrote to memory of 632	1224	taskeng.exe	vcdbbg.exe
PID 1224 wrote to memory of 1160	1224	taskeng.exe	vcdbbg.exe
PID 1224 wrote to memory of 1160	1224	taskeng.exe	vcdbbg.exe
PID 1224 wrote to memory of 1160	1224	taskeng.exe	vcdbbg.exe
PID 1224 wrote to memory of 1160	1224	taskeng.exe	vcdbbg.exe

C:\Users\Admin\AppData\Local\Temp\5350c1492b2359b71a31ba103cc19b4f.exe
"C:\Users\Admin\AppData\Local\Temp\5350c1492b2359b71a31ba103cc19b4f.exe"
1⤵
- Drops file in Windows directory
PID:1748

C:\Windows\system32\taskeng.exe
taskeng.exe {36EB8879-5F14-42FB-BB2B-2D3A06E03A4F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\5350c1492b2359b71a31ba103cc19b4f.exe
C:\Users\Admin\AppData\Local\Temp\5350c1492b2359b71a31ba103cc19b4f.exe start
2⤵
- Drops file in Windows directory
PID:1300

C:\Windows\TEMP\vcdbbg.exe
C:\Windows\TEMP\vcdbbg.exe
2⤵
- Executes dropped EXE
- Deletes itself
- Drops file in Windows directory
PID:632

C:\Windows\TEMP\vcdbbg.exe
C:\Windows\TEMP\vcdbbg.exe start
2⤵
- Executes dropped EXE
PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\TEMP\vcdbbg.exe
MD5
5fc8b735442c0761d95300c3ab2cd3f1

SHA1
0c68b66cd251825596f6a9dbcd9cd664401012c8

SHA256
36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

SHA512
a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Download Submit
C:\Windows\Tasks\wow64.job
MD5
bc3027d68d7715133c319f123c549435

SHA1
4d6bbd589998020b73b2a1d1e9556758e5eda940

SHA256
45c36ea54884d7b6983bc66a182dc30b223b97615bd729f868833c560803421f

SHA512
7e5d62a2026d01ab05dcc3a6622b3715670332e397c0983c1746255e8b6ca62bb8840511b67198824beee280962aa190db537b0971a91daeb7e229c434d10cfa

Download Submit
C:\Windows\Temp\vcdbbg.exe
MD5
5fc8b735442c0761d95300c3ab2cd3f1

SHA1
0c68b66cd251825596f6a9dbcd9cd664401012c8

SHA256
36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

SHA512
a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Download Submit
C:\Windows\Temp\vcdbbg.exe
MD5
5fc8b735442c0761d95300c3ab2cd3f1

SHA1
0c68b66cd251825596f6a9dbcd9cd664401012c8

SHA256
36373b5af4c8b64bff18ae7d2079da5b3cfb6371def687327d9487adb0de345d

SHA512
a49c999e918a1a68ef64bb4ea3d57c4be1a3e1a35ebb4fb603291dc78b45a408202bd40d95b0adb382ae82fffb30d5ce7ffec11db4b108199d62c77d3b6fe797

Download Submit
memory/632-75-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/632-69-0x0000000000000000-mapping.dmp

Download
memory/632-73-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1160-76-0x0000000000000000-mapping.dmp

Download
memory/1160-79-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1160-81-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1300-64-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1300-67-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1300-63-0x0000000000000000-mapping.dmp

Download
memory/1748-62-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/1748-60-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1748-59-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1748-61-0x0000000000380000-0x0000000000385000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing