systembc | 702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3

Analysis

Target

702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe
Size

209KB
MD5

5cdf1b191b0b18d04353640f96c5daef
SHA1

ea46f37af7b78d91934ab0010abaf436437585f9
SHA256

702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3
SHA512

3439b69b3e6db586dc8733094e2ca265a67c58e499c163f4be7d780bf2febe18819163b7e34108a4e3ff6f94e7f770345c099df69b50c82f455dfb15622d0be4

Score

10^/10

systembc trojan

Family

systembc

195.2.73.44:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe
File opened for modification	C:\Windows\Tasks\wow64.job	702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 808 wrote to memory of 1392	808	taskeng.exe	702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe
PID 808 wrote to memory of 1392	808	taskeng.exe	702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe
PID 808 wrote to memory of 1392	808	taskeng.exe	702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe
PID 808 wrote to memory of 1392	808	taskeng.exe	702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe

C:\Users\Admin\AppData\Local\Temp\702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe
"C:\Users\Admin\AppData\Local\Temp\702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe"
1⤵
- Drops file in Windows directory
PID:1716

C:\Windows\system32\taskeng.exe
taskeng.exe {907063A5-F7CD-45E5-8184-E6A56D414B37} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Users\Admin\AppData\Local\Temp\702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe
C:\Users\Admin\AppData\Local\Temp\702a1b613e1293c407192b59d890b208f6a3b0c71c75f292b9d45b566591eda3.exe start
2⤵
PID:1392

memory/1392-60-0x0000000000030000-0x0000000000035000-memory.dmp

Filesize
20KB

Download
memory/1392-61-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1716-56-0x0000000000030000-0x0000000000035000-memory.dmp

Filesize
20KB

Download
memory/1716-55-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/1716-57-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download
memory/1716-58-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download