systembc | 4aec64f64812b8ed41eebe2d561d166b6dc9c16f2a856f7d10408ec83f493c06

Analysis

Target
bc6c722eaa639859b898de9e2ed17832.exe
Size 265KB
Sample220206-jfvmvagea6
SHA256 4aec64f64812b8ed41eebe2d561d166b6dc9c16f2a856f7d10408ec83f493c06
MD5 bc6c722eaa639859b898de9e2ed17832
SHA1 bff54c4071ffecf0e822faea1712cdf7c3770dd8
SHA512 14c01897d4d4e5bc447b149b57d246914017a2b13116de7dd97352fdd4d6609c3b0e5819cdf272fdf4893ea6353eb4a306761dd78739dd8c02e435c02207dc13
MD5 SHA1 SHA512

Score

10^/10

systembc trojan

Family

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\mwfrqn.job	vrouk.exe
File created	C:\Windows\Tasks\ipqrnr.job	bc6c722eaa639859b898de9e2ed17832.exe
File opened for modification	C:\Windows\Tasks\ipqrnr.job	bc6c722eaa639859b898de9e2ed17832.exe
File created	C:\Windows\Tasks\pdfxpfmsvnftbcjwogk.job	ipqrnr.exe
File created	C:\Windows\Tasks\mwfrqn.job	vrouk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1492	bc6c722eaa639859b898de9e2ed17832.exe
1148	vrouk.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1656	1576	taskeng.exe	28
PID 1576 wrote to memory of 1656	1576	taskeng.exe	28
PID 1576 wrote to memory of 1656	1576	taskeng.exe	28
PID 1576 wrote to memory of 1656	1576	taskeng.exe	28
PID 1576 wrote to memory of 1148	1576	taskeng.exe	31
PID 1576 wrote to memory of 1148	1576	taskeng.exe	31
PID 1576 wrote to memory of 1148	1576	taskeng.exe	31
PID 1576 wrote to memory of 1148	1576	taskeng.exe	31
PID 1576 wrote to memory of 924	1576	taskeng.exe	32
PID 1576 wrote to memory of 924	1576	taskeng.exe	32
PID 1576 wrote to memory of 924	1576	taskeng.exe	32
PID 1576 wrote to memory of 924	1576	taskeng.exe	32

C:\Windows\system32\taskeng.exe
taskeng.exe {1DB10330-8240-4569-B5E9-89323491BBE6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\ProgramData\fehd\ipqrnr.exe
  C:\ProgramData\fehd\ipqrnr.exe start
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1656
- C:\Windows\TEMP\vrouk.exe
  C:\Windows\TEMP\vrouk.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\ProgramData\pdeoab\mwfrqn.exe
  C:\ProgramData\pdeoab\mwfrqn.exe start
  2⤵
  - Executes dropped EXE
  PID:924

memory/1148-69-0x0000000000400000-0x0000000002C26000-memory.dmp

Download

memory/1148-67-0x00000000002E0000-0x00000000002E9000-memory.dmp

Download

memory/1492-58-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/1492-55-0x0000000000620000-0x000000000064F000-memory.dmp

Download

memory/1492-57-0x0000000000220000-0x0000000000229000-memory.dmp

Download

memory/1492-56-0x00000000769D1000-0x00000000769D3000-memory.dmp

Download

memory/1656-63-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/1656-61-0x0000000000590000-0x00000000005BF000-memory.dmp

Download