systembc | cd6cca6f8ad176e1c42b19ad7b7d0c8fb2cb7735b4319fc14f868445affa0236

Analysis

Target

20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe
Size

388KB
MD5

20898d2a1ca2b9ceb0953c7a2cc4e0a5
SHA1

af0a15dd380ce076cdce5374e38d4739cc2de332
SHA256

cd6cca6f8ad176e1c42b19ad7b7d0c8fb2cb7735b4319fc14f868445affa0236
SHA512

4e643f8d6c10953973beda96bc4e8886f854e340cc538e838f04887470c85e33024631dc58f1a4e60626afad88954d41fe484c1509c44af9e300b515754a556a

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe
File opened for modification	C:\Windows\Tasks\wow64.job	20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1708 wrote to memory of 1404	1708	taskeng.exe	20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe
PID 1708 wrote to memory of 1404	1708	taskeng.exe	20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe
PID 1708 wrote to memory of 1404	1708	taskeng.exe	20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe
PID 1708 wrote to memory of 1404	1708	taskeng.exe	20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe

C:\Users\Admin\AppData\Local\Temp\20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe
"C:\Users\Admin\AppData\Local\Temp\20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe"
1⤵
- Drops file in Windows directory
PID:1200

C:\Windows\system32\taskeng.exe
taskeng.exe {4D0F4645-5AE4-47B6-97EA-14B9F4B125D0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe
C:\Users\Admin\AppData\Local\Temp\20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe start
2⤵
PID:1404

memory/1200-60-0x00000000768B1000-0x00000000768B3000-memory.dmp

Filesize
8KB

Download
memory/1200-61-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1200-63-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1200-62-0x0000000000260000-0x0000000000265000-memory.dmp

Filesize
20KB

Download
memory/1404-64-0x0000000000000000-mapping.dmp

Download
memory/1404-65-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1404-68-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download