systembc | 78047ece6080c704f47d91545e8cce53095342a4595b9e20ee5efeba4c679e41

Analysis

Target

825a13bbff9b5cc4d1f19d896aa31c64.exe
Size

780KB
MD5

825a13bbff9b5cc4d1f19d896aa31c64
SHA1

a2026995b7871f84fbdd86f2596d51ce4f05f8b1
SHA256

78047ece6080c704f47d91545e8cce53095342a4595b9e20ee5efeba4c679e41
SHA512

ef52dcfecf5d916cb4eb17e03771d45d051c561c48564c114815a299cf77dd98d6547a1e2bfc3e133e2e97337b4bb258b776cadbe43a0b3beb0c987bb16d7197

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

825a13bbff9b5cc4d1f19d896aa31c64.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	825a13bbff9b5cc4d1f19d896aa31c64.exe
File opened for modification	C:\Windows\Tasks\wow64.job	825a13bbff9b5cc4d1f19d896aa31c64.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1088 wrote to memory of 1280	1088	taskeng.exe	825a13bbff9b5cc4d1f19d896aa31c64.exe
PID 1088 wrote to memory of 1280	1088	taskeng.exe	825a13bbff9b5cc4d1f19d896aa31c64.exe
PID 1088 wrote to memory of 1280	1088	taskeng.exe	825a13bbff9b5cc4d1f19d896aa31c64.exe
PID 1088 wrote to memory of 1280	1088	taskeng.exe	825a13bbff9b5cc4d1f19d896aa31c64.exe

C:\Users\Admin\AppData\Local\Temp\825a13bbff9b5cc4d1f19d896aa31c64.exe
"C:\Users\Admin\AppData\Local\Temp\825a13bbff9b5cc4d1f19d896aa31c64.exe"
1⤵
- Drops file in Windows directory
PID:1012

C:\Windows\system32\taskeng.exe
taskeng.exe {9A401005-B557-4FCA-842D-1AD4C35328F4} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\825a13bbff9b5cc4d1f19d896aa31c64.exe
C:\Users\Admin\AppData\Local\Temp\825a13bbff9b5cc4d1f19d896aa31c64.exe start
2⤵
PID:1280

memory/1012-59-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1012-61-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download
memory/1012-62-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/1012-60-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1280-63-0x0000000000000000-mapping.dmp

Download
memory/1280-65-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1280-67-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download