systembc | ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca

Analysis

Target

ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca.exe
Size

76KB
MD5

1b0c09e2348b91bcb0b3f5310789863a
SHA1

916420085c30d8b96a4bd93647803c0d662cce18
SHA256

ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca
SHA512

45c08923dfbb514bd6c3525d07f813954daa5254723b107e2d3ac8139366bb3304d6c681f64bb377c84cfd79a0f6f1844cc2edd68daf3901754b350b49da6e6e

Score

10^/10

systembc trojan

Family

systembc

141.255.166.149:4125

5.188.62.165:4125

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

mdcnhh.exe

pid process

1340 mdcnhh.exe

pid	process
1340	mdcnhh.exe

Drops file in Windows directory 2 IoCs

Processes:

ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca.exe

description	ioc	process
File created	C:\Windows\Tasks\mdcnhh.job	ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca.exe
File opened for modification	C:\Windows\Tasks\mdcnhh.job	ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca.exe

pid process

804 ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca.exe

pid	process
804	ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 524 wrote to memory of 1340	524	taskeng.exe	mdcnhh.exe
PID 524 wrote to memory of 1340	524	taskeng.exe	mdcnhh.exe
PID 524 wrote to memory of 1340	524	taskeng.exe	mdcnhh.exe
PID 524 wrote to memory of 1340	524	taskeng.exe	mdcnhh.exe

C:\Windows\system32\taskeng.exe
taskeng.exe {5A1461A0-2219-4DA9-AA95-694BF904D5CB} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:524

C:\ProgramData\kqcbpg\mdcnhh.exe
C:\ProgramData\kqcbpg\mdcnhh.exe start
2⤵
- Executes dropped EXE
PID:1340

C:\ProgramData\kqcbpg\mdcnhh.exe
MD5
1b0c09e2348b91bcb0b3f5310789863a

SHA1
916420085c30d8b96a4bd93647803c0d662cce18

SHA256
ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca

SHA512
45c08923dfbb514bd6c3525d07f813954daa5254723b107e2d3ac8139366bb3304d6c681f64bb377c84cfd79a0f6f1844cc2edd68daf3901754b350b49da6e6e

Download Submit
C:\ProgramData\kqcbpg\mdcnhh.exe
MD5
1b0c09e2348b91bcb0b3f5310789863a

SHA1
916420085c30d8b96a4bd93647803c0d662cce18

SHA256
ee42a34b83f4c27c57ebfa79f78d4702cdf5c845443b929b9e9d3246409aacca

SHA512
45c08923dfbb514bd6c3525d07f813954daa5254723b107e2d3ac8139366bb3304d6c681f64bb377c84cfd79a0f6f1844cc2edd68daf3901754b350b49da6e6e

Download Submit
memory/804-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/804-55-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download
memory/804-56-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/1340-60-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download