systembc | 2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7 | Triage

Analysis

max time kernel
147s
max time network
195s
platform
windows7_x64
resource
win7v20210410
submitted
02-07-2021 15:10

Sharing

Report Analysis Logs

General

Target

2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe
Size

191KB
MD5

691c98b8cefece16707c7b0bd354691c
SHA1

c73c7e26cfa54781676583a8cca4f670a60f4db2
SHA256

2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7
SHA512

dcf882286ce5e2edd2b9b3faa179bad920257566d4e907e6039b4db111ead36e7b02ae8ae3213118870d2b7e24d84f0fce158f3e3e9871e958b9a4ac8b067275

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

62.113.114.79:4001

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\wow64.job	2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe
File created	C:\Windows\Tasks\wow64.job	2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1584 wrote to memory of 1720	1584	taskeng.exe	2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe
PID 1584 wrote to memory of 1720	1584	taskeng.exe	2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe
PID 1584 wrote to memory of 1720	1584	taskeng.exe	2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe
PID 1584 wrote to memory of 1720	1584	taskeng.exe	2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe

C:\Users\Admin\AppData\Local\Temp\2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe
"C:\Users\Admin\AppData\Local\Temp\2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe"
1⤵
- Drops file in Windows directory
PID:1092

C:\Windows\system32\taskeng.exe
taskeng.exe {1939B583-ECCF-4A08-B226-BFAB7FE42B8E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\AppData\Local\Temp\2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe
C:\Users\Admin\AppData\Local\Temp\2cbcf10a8ddfd7fd306fa0440eb9dac70b9ca39770222b62af5d372446f194a7.exe start
2⤵
PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-59-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1092-62-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1092-61-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/1720-60-0x0000000000000000-mapping.dmp

Download
memory/1720-65-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download