systembc | 708ae5ceb7fc86d1d8d3c0597015f5e3fd4aa8af07faec1f4b75d94b2ebce6c1

Analysis

Target

0acb9ab7d6449949dabbc716c8b890cc.exe
Size

830KB
MD5

0acb9ab7d6449949dabbc716c8b890cc
SHA1

47574d6168cf994f38844a540ee4bc21087eef88
SHA256

708ae5ceb7fc86d1d8d3c0597015f5e3fd4aa8af07faec1f4b75d94b2ebce6c1
SHA512

40217a51fb6676da16e24300badeacc2aa6c9252c4ba2f03912e86dc704fb290ae83b1f4cada8e8655f189272c8203d2d3a72d41c42fa8c817957547bb60b938

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

0acb9ab7d6449949dabbc716c8b890cc.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	0acb9ab7d6449949dabbc716c8b890cc.exe
File opened for modification	C:\Windows\Tasks\wow64.job	0acb9ab7d6449949dabbc716c8b890cc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 848 wrote to memory of 2040	848	taskeng.exe	0acb9ab7d6449949dabbc716c8b890cc.exe
PID 848 wrote to memory of 2040	848	taskeng.exe	0acb9ab7d6449949dabbc716c8b890cc.exe
PID 848 wrote to memory of 2040	848	taskeng.exe	0acb9ab7d6449949dabbc716c8b890cc.exe
PID 848 wrote to memory of 2040	848	taskeng.exe	0acb9ab7d6449949dabbc716c8b890cc.exe

C:\Users\Admin\AppData\Local\Temp\0acb9ab7d6449949dabbc716c8b890cc.exe
"C:\Users\Admin\AppData\Local\Temp\0acb9ab7d6449949dabbc716c8b890cc.exe"
1⤵
- Drops file in Windows directory
PID:736

C:\Windows\system32\taskeng.exe
taskeng.exe {9F124E98-4CC7-4A9B-AD0D-A2FE9301C861} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Users\Admin\AppData\Local\Temp\0acb9ab7d6449949dabbc716c8b890cc.exe
C:\Users\Admin\AppData\Local\Temp\0acb9ab7d6449949dabbc716c8b890cc.exe start
2⤵
PID:2040

memory/736-60-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/736-61-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/736-62-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download
memory/736-63-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2040-64-0x0000000000000000-mapping.dmp

Download
memory/2040-66-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2040-68-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download