systembc | 249e53beb5992ce00d694688998e54743fcc74ad4f2942be7f66596b8c0a8867

Analysis

Target

26e9fcf63f321363b555a2bbe423c5ee.exe
Size

780KB
MD5

26e9fcf63f321363b555a2bbe423c5ee
SHA1

5e7d7acb5e4c3ff3586740dfb556fe5ba53e947e
SHA256

249e53beb5992ce00d694688998e54743fcc74ad4f2942be7f66596b8c0a8867
SHA512

4ebd7445c1e8be832d69b2b1b669b74d7524bd219b9d325ca009feb298a542f377906598978ec07a9bfed1ec8ef268224f9f86bfa8ca13e934f73be307d87641

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

26e9fcf63f321363b555a2bbe423c5ee.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	26e9fcf63f321363b555a2bbe423c5ee.exe
File opened for modification	C:\Windows\Tasks\wow64.job	26e9fcf63f321363b555a2bbe423c5ee.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1280 wrote to memory of 1420	1280	taskeng.exe	26e9fcf63f321363b555a2bbe423c5ee.exe
PID 1280 wrote to memory of 1420	1280	taskeng.exe	26e9fcf63f321363b555a2bbe423c5ee.exe
PID 1280 wrote to memory of 1420	1280	taskeng.exe	26e9fcf63f321363b555a2bbe423c5ee.exe
PID 1280 wrote to memory of 1420	1280	taskeng.exe	26e9fcf63f321363b555a2bbe423c5ee.exe

C:\Users\Admin\AppData\Local\Temp\26e9fcf63f321363b555a2bbe423c5ee.exe
"C:\Users\Admin\AppData\Local\Temp\26e9fcf63f321363b555a2bbe423c5ee.exe"
1⤵
- Drops file in Windows directory
PID:1816

C:\Windows\system32\taskeng.exe
taskeng.exe {6A37D9D6-A723-48B3-A3AB-6CC455FFB709} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\26e9fcf63f321363b555a2bbe423c5ee.exe
C:\Users\Admin\AppData\Local\Temp\26e9fcf63f321363b555a2bbe423c5ee.exe start
2⤵
PID:1420

memory/1420-64-0x0000000000000000-mapping.dmp

Download
memory/1420-66-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1420-68-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/1816-60-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1816-62-0x0000000000260000-0x0000000000265000-memory.dmp

Filesize
20KB

Download
memory/1816-61-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1816-63-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download