systembc | bfc410665215437c98d3fec91f281824326a73565224e9ad20685eb86c632338

Analysis

Target

63d21a9cac7a5f2874f02137e632945e.exe
Size

515KB
MD5

63d21a9cac7a5f2874f02137e632945e
SHA1

450d686e1c923d414ac5d4fbeff99453b4497f4c
SHA256

bfc410665215437c98d3fec91f281824326a73565224e9ad20685eb86c632338
SHA512

55b1333e893dd47b49c71e6ddde964e587be7ffdb2067bd405edfe12ff0da5f70969cffff0ff133e71d59526e7de2ee4fe8cc0eaf43cb7c1238736aa0fa97596

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

63d21a9cac7a5f2874f02137e632945e.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	63d21a9cac7a5f2874f02137e632945e.exe
File opened for modification	C:\Windows\Tasks\wow64.job	63d21a9cac7a5f2874f02137e632945e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1660 wrote to memory of 1764	1660	taskeng.exe	63d21a9cac7a5f2874f02137e632945e.exe
PID 1660 wrote to memory of 1764	1660	taskeng.exe	63d21a9cac7a5f2874f02137e632945e.exe
PID 1660 wrote to memory of 1764	1660	taskeng.exe	63d21a9cac7a5f2874f02137e632945e.exe
PID 1660 wrote to memory of 1764	1660	taskeng.exe	63d21a9cac7a5f2874f02137e632945e.exe

C:\Users\Admin\AppData\Local\Temp\63d21a9cac7a5f2874f02137e632945e.exe
"C:\Users\Admin\AppData\Local\Temp\63d21a9cac7a5f2874f02137e632945e.exe"
1⤵
- Drops file in Windows directory
PID:1932

C:\Windows\system32\taskeng.exe
taskeng.exe {3A163CA5-72BA-4D0C-89E7-7273BDC98871} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Local\Temp\63d21a9cac7a5f2874f02137e632945e.exe
C:\Users\Admin\AppData\Local\Temp\63d21a9cac7a5f2874f02137e632945e.exe start
2⤵
PID:1764

memory/1764-63-0x0000000000000000-mapping.dmp

Download
memory/1764-64-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1764-67-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1932-59-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1932-61-0x0000000000280000-0x0000000000285000-memory.dmp

Filesize
20KB

Download
memory/1932-60-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1932-62-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download