systembc | f207b081630595fb1b6d790e7c43ec89fe2ed88003026f5d0f9faf01c99673e2

Analysis

Target

dca879ef4e2ae31f1eb398f15434ab02.exe
Size

388KB
MD5

dca879ef4e2ae31f1eb398f15434ab02
SHA1

cf1698d56831e67197652bba3c5f5fdfc1ffeea5
SHA256

f207b081630595fb1b6d790e7c43ec89fe2ed88003026f5d0f9faf01c99673e2
SHA512

78fd43276612bc473787b9010967536a07caf3f262469771986ea6201681f60f813deb524e61242286b054cb28d9e65f384b0a0ceb6358cd196ec33d68d0bfe5

Score

10^/10

systembc trojan

Family

systembc

185.215.113.32:4000

78.47.64.46:4000

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

dca879ef4e2ae31f1eb398f15434ab02.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\wow64.job	dca879ef4e2ae31f1eb398f15434ab02.exe
File created	C:\Windows\Tasks\wow64.job	dca879ef4e2ae31f1eb398f15434ab02.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1760 wrote to memory of 1216	1760	taskeng.exe	dca879ef4e2ae31f1eb398f15434ab02.exe
PID 1760 wrote to memory of 1216	1760	taskeng.exe	dca879ef4e2ae31f1eb398f15434ab02.exe
PID 1760 wrote to memory of 1216	1760	taskeng.exe	dca879ef4e2ae31f1eb398f15434ab02.exe
PID 1760 wrote to memory of 1216	1760	taskeng.exe	dca879ef4e2ae31f1eb398f15434ab02.exe

C:\Users\Admin\AppData\Local\Temp\dca879ef4e2ae31f1eb398f15434ab02.exe
"C:\Users\Admin\AppData\Local\Temp\dca879ef4e2ae31f1eb398f15434ab02.exe"
1⤵
- Drops file in Windows directory
PID:1860

C:\Windows\system32\taskeng.exe
taskeng.exe {FDB6C1B1-71B7-4716-B393-5AA7864CFBD1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\dca879ef4e2ae31f1eb398f15434ab02.exe
C:\Users\Admin\AppData\Local\Temp\dca879ef4e2ae31f1eb398f15434ab02.exe start
2⤵
PID:1216

memory/1216-63-0x0000000000000000-mapping.dmp

Download
memory/1216-65-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1216-67-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1860-59-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1860-60-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1860-62-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1860-61-0x00000000003E0000-0x00000000003E5000-memory.dmp

Filesize
20KB

Download