systembc | 53ca800262b15721bf8451e7999c935e65d4eb058126e3c1d4eb9942c9c60858

Analysis

Target

b6b48f39779a00c8b8a6fe8ed9db1609.exe
Size

284KB
MD5

b6b48f39779a00c8b8a6fe8ed9db1609
SHA1

3ce9a028d2596d2d827d2a0e3d407a1e6ae83f81
SHA256

53ca800262b15721bf8451e7999c935e65d4eb058126e3c1d4eb9942c9c60858
SHA512

66ac08eefe461db61df8c817a593ebe5f4413d8fb35bdc1ecb6384930de8b1d5977b20c7ff77c5f3c1816687c8df0df1bf0d869367d3edd8f18b8c97a7880259

Score

10^/10

systembc trojan

Family

systembc

5.39.221.47:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

b6b48f39779a00c8b8a6fe8ed9db1609.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	b6b48f39779a00c8b8a6fe8ed9db1609.exe
File opened for modification	C:\Windows\Tasks\wow64.job	b6b48f39779a00c8b8a6fe8ed9db1609.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 652 wrote to memory of 1060	652	taskeng.exe	b6b48f39779a00c8b8a6fe8ed9db1609.exe
PID 652 wrote to memory of 1060	652	taskeng.exe	b6b48f39779a00c8b8a6fe8ed9db1609.exe
PID 652 wrote to memory of 1060	652	taskeng.exe	b6b48f39779a00c8b8a6fe8ed9db1609.exe
PID 652 wrote to memory of 1060	652	taskeng.exe	b6b48f39779a00c8b8a6fe8ed9db1609.exe

C:\Users\Admin\AppData\Local\Temp\b6b48f39779a00c8b8a6fe8ed9db1609.exe
"C:\Users\Admin\AppData\Local\Temp\b6b48f39779a00c8b8a6fe8ed9db1609.exe"
1⤵
- Drops file in Windows directory
PID:744

C:\Windows\system32\taskeng.exe
taskeng.exe {98B3C5FC-DA2E-4AFB-9F91-14A80D9403D2} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Users\Admin\AppData\Local\Temp\b6b48f39779a00c8b8a6fe8ed9db1609.exe
C:\Users\Admin\AppData\Local\Temp\b6b48f39779a00c8b8a6fe8ed9db1609.exe start
2⤵
PID:1060

memory/744-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/744-56-0x0000000000030000-0x0000000000035000-memory.dmp

Filesize
20KB

Download
memory/744-55-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/744-57-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1060-59-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download