systembc | bc37b9feb0202a795c125de0396621dd839f21e4c7e4dd598c452f45cf803e97

Analysis

Target

zbetcheckin.exe
Size

515KB
MD5

1b457c64a5bb3a25bfae25a686cfcee0
SHA1

275a27c5500e0471780abb90d8c58feb0d5f251f
SHA256

bc37b9feb0202a795c125de0396621dd839f21e4c7e4dd598c452f45cf803e97
SHA512

7238e332e16886e1c8147ca8ed42f5c88fbf1bbb24d0dcd30748b3e4b817a5841bfdb0f4c4450c62b647da4ef53307691f11183819ff5d6b451933af14c4ace1

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Drops file in Windows directory 2 IoCs

Processes:

zbetcheckin.exe

description ioc process

File opened for modification C:\Windows\Tasks\wow64.job zbetcheckin.exe
File created C:\Windows\Tasks\wow64.job zbetcheckin.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\wow64.job	zbetcheckin.exe
File created	C:\Windows\Tasks\wow64.job	zbetcheckin.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1704 wrote to memory of 1072	1704	taskeng.exe	zbetcheckin.exe
PID 1704 wrote to memory of 1072	1704	taskeng.exe	zbetcheckin.exe
PID 1704 wrote to memory of 1072	1704	taskeng.exe	zbetcheckin.exe
PID 1704 wrote to memory of 1072	1704	taskeng.exe	zbetcheckin.exe

C:\Users\Admin\AppData\Local\Temp\zbetcheckin.exe
"C:\Users\Admin\AppData\Local\Temp\zbetcheckin.exe"
1⤵
- Drops file in Windows directory
PID:2004

C:\Windows\system32\taskeng.exe
taskeng.exe {2896C1B3-4495-4656-B8FE-B2994E9F3AFD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\zbetcheckin.exe
C:\Users\Admin\AppData\Local\Temp\zbetcheckin.exe start
2⤵
PID:1072

memory/1072-64-0x0000000000000000-mapping.dmp

Download
memory/1072-66-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1072-68-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2004-60-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/2004-62-0x0000000000260000-0x0000000000265000-memory.dmp

Filesize
20KB

Download
memory/2004-63-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2004-61-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download