systembc | 84942f3b5f4ddd9f393b42d5a1968a4b5bf5bbf45de0c6a95eba61eb20dc5070

Analysis

Target

32b16aac379f192f71c5c46b6cd8f176.exe
Size

627KB
MD5

32b16aac379f192f71c5c46b6cd8f176
SHA1

fa0a0e78eaffb35cd2e1d7b3749e81de551b0661
SHA256

84942f3b5f4ddd9f393b42d5a1968a4b5bf5bbf45de0c6a95eba61eb20dc5070
SHA512

6fa7194e5be6e71f9a16b7cc19cb0703113ae885044b90aca6f7c1e8a79c8fc21b405ae2f9245c4d68ecc76c531c37ea6803ce9a71b7ace8851cecb9100212fc

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

32b16aac379f192f71c5c46b6cd8f176.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	32b16aac379f192f71c5c46b6cd8f176.exe
File opened for modification	C:\Windows\Tasks\wow64.job	32b16aac379f192f71c5c46b6cd8f176.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1532 wrote to memory of 512	1532	taskeng.exe	32b16aac379f192f71c5c46b6cd8f176.exe
PID 1532 wrote to memory of 512	1532	taskeng.exe	32b16aac379f192f71c5c46b6cd8f176.exe
PID 1532 wrote to memory of 512	1532	taskeng.exe	32b16aac379f192f71c5c46b6cd8f176.exe
PID 1532 wrote to memory of 512	1532	taskeng.exe	32b16aac379f192f71c5c46b6cd8f176.exe

C:\Users\Admin\AppData\Local\Temp\32b16aac379f192f71c5c46b6cd8f176.exe
"C:\Users\Admin\AppData\Local\Temp\32b16aac379f192f71c5c46b6cd8f176.exe"
1⤵
- Drops file in Windows directory
PID:1916

C:\Windows\system32\taskeng.exe
taskeng.exe {A809CD8B-FA89-41AC-AA67-EA0FEB571FA9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Users\Admin\AppData\Local\Temp\32b16aac379f192f71c5c46b6cd8f176.exe
C:\Users\Admin\AppData\Local\Temp\32b16aac379f192f71c5c46b6cd8f176.exe start
2⤵
PID:512

memory/512-64-0x0000000000000000-mapping.dmp

Download
memory/512-66-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/512-68-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1916-60-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1916-61-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1916-62-0x0000000000260000-0x0000000000265000-memory.dmp

Filesize
20KB

Download
memory/1916-63-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download