systembc | 74bc8cc794e98d78ac8e4d6eac70cec70e4c8b1359e53e48f653cac84bafdae0

Resubmissions

18-11-2021 19:27

14-11-2021 07:31

Target

1d2d5950861d191f0cf126bf80e1857e.exe
Size

156KB
MD5

1d2d5950861d191f0cf126bf80e1857e
SHA1

d7161ac371c18a87023ce37036bcd25d09d7baa4
SHA256

74bc8cc794e98d78ac8e4d6eac70cec70e4c8b1359e53e48f653cac84bafdae0
SHA512

d189722b83816fcf20bea216e9da1832d44fffe52d5d7c06564f1505d8ccfc15f1cbe106260a14f4a8858eeba047d519a3e46d6e87cef3ffe630c2d1cb42cc63

Score

10^/10

systembc trojan

Family

systembc

91.212.150.113:4199

192.53.123.202:4199

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

1d2d5950861d191f0cf126bf80e1857e.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	1d2d5950861d191f0cf126bf80e1857e.exe
File opened for modification	C:\Windows\Tasks\wow64.job	1d2d5950861d191f0cf126bf80e1857e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 580 wrote to memory of 1908	580	taskeng.exe	1d2d5950861d191f0cf126bf80e1857e.exe
PID 580 wrote to memory of 1908	580	taskeng.exe	1d2d5950861d191f0cf126bf80e1857e.exe
PID 580 wrote to memory of 1908	580	taskeng.exe	1d2d5950861d191f0cf126bf80e1857e.exe
PID 580 wrote to memory of 1908	580	taskeng.exe	1d2d5950861d191f0cf126bf80e1857e.exe

C:\Users\Admin\AppData\Local\Temp\1d2d5950861d191f0cf126bf80e1857e.exe
"C:\Users\Admin\AppData\Local\Temp\1d2d5950861d191f0cf126bf80e1857e.exe"
1⤵
- Drops file in Windows directory
PID:908

C:\Windows\system32\taskeng.exe
taskeng.exe {E8B6F811-C332-4B60-8638-8BDFF29C297F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Users\Admin\AppData\Local\Temp\1d2d5950861d191f0cf126bf80e1857e.exe
  C:\Users\Admin\AppData\Local\Temp\1d2d5950861d191f0cf126bf80e1857e.exe start
  2⤵
  PID:1908

memory/908-55-0x0000000075B71000-0x0000000075B73000-memory.dmp

Filesize
8KB

Download
memory/908-57-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/908-56-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/908-58-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1908-59-0x0000000000000000-mapping.dmp

Download
memory/1908-61-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download