systembc | bc37b9feb0202a795c125de0396621dd839f21e4c7e4dd598c452f45cf803e97

Analysis

Target

1b457c64a5bb3a25bfae25a686cfcee0.exe
Size

515KB
MD5

1b457c64a5bb3a25bfae25a686cfcee0
SHA1

275a27c5500e0471780abb90d8c58feb0d5f251f
SHA256

bc37b9feb0202a795c125de0396621dd839f21e4c7e4dd598c452f45cf803e97
SHA512

7238e332e16886e1c8147ca8ed42f5c88fbf1bbb24d0dcd30748b3e4b817a5841bfdb0f4c4450c62b647da4ef53307691f11183819ff5d6b451933af14c4ace1

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

1b457c64a5bb3a25bfae25a686cfcee0.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	1b457c64a5bb3a25bfae25a686cfcee0.exe
File opened for modification	C:\Windows\Tasks\wow64.job	1b457c64a5bb3a25bfae25a686cfcee0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1796 wrote to memory of 1064	1796	taskeng.exe	1b457c64a5bb3a25bfae25a686cfcee0.exe
PID 1796 wrote to memory of 1064	1796	taskeng.exe	1b457c64a5bb3a25bfae25a686cfcee0.exe
PID 1796 wrote to memory of 1064	1796	taskeng.exe	1b457c64a5bb3a25bfae25a686cfcee0.exe
PID 1796 wrote to memory of 1064	1796	taskeng.exe	1b457c64a5bb3a25bfae25a686cfcee0.exe

C:\Users\Admin\AppData\Local\Temp\1b457c64a5bb3a25bfae25a686cfcee0.exe
"C:\Users\Admin\AppData\Local\Temp\1b457c64a5bb3a25bfae25a686cfcee0.exe"
1⤵
- Drops file in Windows directory
PID:1348

C:\Windows\system32\taskeng.exe
taskeng.exe {4268982B-17B6-481D-8980-52C2C91D24E3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\1b457c64a5bb3a25bfae25a686cfcee0.exe
C:\Users\Admin\AppData\Local\Temp\1b457c64a5bb3a25bfae25a686cfcee0.exe start
2⤵
PID:1064

memory/1064-64-0x0000000000000000-mapping.dmp

Download
memory/1064-66-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1064-68-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1348-60-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1348-62-0x0000000000490000-0x0000000000495000-memory.dmp

Filesize
20KB

Download
memory/1348-61-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1348-63-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download