systembc | 5c438f86021fd06082e385cbc634358ff271f5cc2402fa2fcc7356dd00370925

Analysis

Target

80a8f2eeb88a172085ef05f8e99a7de8.exe
Size

515KB
MD5

80a8f2eeb88a172085ef05f8e99a7de8
SHA1

db3160eac7dba9fc00ffb5a3e6901f4e10817dc7
SHA256

5c438f86021fd06082e385cbc634358ff271f5cc2402fa2fcc7356dd00370925
SHA512

f6c093b32354020fd8b90bc2e8b0790f9ec53415e4853f04ee3f6de800529659e77a2c758aec1fa2539bc4e8cf192316826785393f82826a1cc81f9bddde4146

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

80a8f2eeb88a172085ef05f8e99a7de8.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\wow64.job	80a8f2eeb88a172085ef05f8e99a7de8.exe
File created	C:\Windows\Tasks\wow64.job	80a8f2eeb88a172085ef05f8e99a7de8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1704 wrote to memory of 608	1704	taskeng.exe	80a8f2eeb88a172085ef05f8e99a7de8.exe
PID 1704 wrote to memory of 608	1704	taskeng.exe	80a8f2eeb88a172085ef05f8e99a7de8.exe
PID 1704 wrote to memory of 608	1704	taskeng.exe	80a8f2eeb88a172085ef05f8e99a7de8.exe
PID 1704 wrote to memory of 608	1704	taskeng.exe	80a8f2eeb88a172085ef05f8e99a7de8.exe

C:\Users\Admin\AppData\Local\Temp\80a8f2eeb88a172085ef05f8e99a7de8.exe
"C:\Users\Admin\AppData\Local\Temp\80a8f2eeb88a172085ef05f8e99a7de8.exe"
1⤵
- Drops file in Windows directory
PID:1096

C:\Windows\system32\taskeng.exe
taskeng.exe {BA0F9E3A-82BB-4FDB-A5EC-B4AC34F7F9EA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\80a8f2eeb88a172085ef05f8e99a7de8.exe
C:\Users\Admin\AppData\Local\Temp\80a8f2eeb88a172085ef05f8e99a7de8.exe start
2⤵
PID:608

memory/608-63-0x0000000000000000-mapping.dmp

Download
memory/608-65-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/608-67-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1096-59-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1096-62-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1096-61-0x00000000003F0000-0x00000000003F5000-memory.dmp

Filesize
20KB

Download
memory/1096-60-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download