systembc | 742a97dbebd3f760b215186d04655dfcaf3846b40d3390a2db9bd7ee5f3d3266

Analysis

Target

cad73181081242b8a48532b8c69fe646.exe
Size

755KB
MD5

cad73181081242b8a48532b8c69fe646
SHA1

5ff865d40e6f73fa5b6a3d8799e621cd9ce2d66d
SHA256

742a97dbebd3f760b215186d04655dfcaf3846b40d3390a2db9bd7ee5f3d3266
SHA512

6098cb0ca40dd1e774ccb06b82fa8ccd2bd2f3280576a3fb55762bef1f73efcf0a9014547f571345b3e4ba009e4e75110bd782bb911de7b5daa8760b354303ed

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

cad73181081242b8a48532b8c69fe646.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	cad73181081242b8a48532b8c69fe646.exe
File opened for modification	C:\Windows\Tasks\wow64.job	cad73181081242b8a48532b8c69fe646.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1764 wrote to memory of 1372	1764	taskeng.exe	cad73181081242b8a48532b8c69fe646.exe
PID 1764 wrote to memory of 1372	1764	taskeng.exe	cad73181081242b8a48532b8c69fe646.exe
PID 1764 wrote to memory of 1372	1764	taskeng.exe	cad73181081242b8a48532b8c69fe646.exe
PID 1764 wrote to memory of 1372	1764	taskeng.exe	cad73181081242b8a48532b8c69fe646.exe

C:\Users\Admin\AppData\Local\Temp\cad73181081242b8a48532b8c69fe646.exe
"C:\Users\Admin\AppData\Local\Temp\cad73181081242b8a48532b8c69fe646.exe"
1⤵
- Drops file in Windows directory
PID:1208

C:\Windows\system32\taskeng.exe
taskeng.exe {8E135CAC-2D50-43A2-906E-DBFF326898FE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Users\Admin\AppData\Local\Temp\cad73181081242b8a48532b8c69fe646.exe
C:\Users\Admin\AppData\Local\Temp\cad73181081242b8a48532b8c69fe646.exe start
2⤵
PID:1372

memory/1208-60-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download
memory/1208-62-0x00000000003E0000-0x00000000003E5000-memory.dmp

Filesize
20KB

Download
memory/1208-61-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1208-63-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1372-64-0x0000000000000000-mapping.dmp

Download
memory/1372-65-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1372-68-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download