systembc | 89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8

General

Target

89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe
Size

80KB
MD5

eeba84917c10f83b80625d288201a85f
SHA1

043b34dafb1e23388c34fc9523cad171fa4b507c
SHA256

89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8
SHA512

753c310eb1ada398972546a37c44e94bcf0bd8a550bd559ba6bc304eb6930c3938b8c5acee81a245b8e1ff9bb811e6feb0a0d8f36d0029fc34be981794d8a0d6

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

devstudiakomp.com:4138

devstudiakomp.xyz:4138

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

wxbd.exe

pid process

2024 wxbd.exe

pid	process
2024	wxbd.exe

Drops file in Windows directory 2 IoCs

Processes:

89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe

description	ioc	process
File created	C:\Windows\Tasks\wxbd.job	89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe
File opened for modification	C:\Windows\Tasks\wxbd.job	89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1180 wrote to memory of 2024	1180	taskeng.exe	wxbd.exe
PID 1180 wrote to memory of 2024	1180	taskeng.exe	wxbd.exe
PID 1180 wrote to memory of 2024	1180	taskeng.exe	wxbd.exe
PID 1180 wrote to memory of 2024	1180	taskeng.exe	wxbd.exe

C:\Users\Admin\AppData\Local\Temp\89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe
"C:\Users\Admin\AppData\Local\Temp\89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8.exe"
1⤵
- Drops file in Windows directory
PID:1976

C:\Windows\system32\taskeng.exe
taskeng.exe {6DAEAF14-9778-4012-B89C-3D616D663D65} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\ProgramData\juocu\wxbd.exe
C:\ProgramData\juocu\wxbd.exe start
2⤵
- Executes dropped EXE
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\juocu\wxbd.exe
Filesize
80KB

MD5
eeba84917c10f83b80625d288201a85f

SHA1
043b34dafb1e23388c34fc9523cad171fa4b507c

SHA256
89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8

SHA512
753c310eb1ada398972546a37c44e94bcf0bd8a550bd559ba6bc304eb6930c3938b8c5acee81a245b8e1ff9bb811e6feb0a0d8f36d0029fc34be981794d8a0d6

Download Submit
C:\ProgramData\juocu\wxbd.exe
Filesize
80KB

MD5
eeba84917c10f83b80625d288201a85f

SHA1
043b34dafb1e23388c34fc9523cad171fa4b507c

SHA256
89739bfe67944f401eac6768d7e8e08a6a167b6e7a9b531ae63607b914eaa7a8

SHA512
753c310eb1ada398972546a37c44e94bcf0bd8a550bd559ba6bc304eb6930c3938b8c5acee81a245b8e1ff9bb811e6feb0a0d8f36d0029fc34be981794d8a0d6

Download Submit
memory/1976-54-0x000000000318B000-0x000000000318F000-memory.dmp

Filesize
16KB

Download
memory/1976-55-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1976-57-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/1976-56-0x000000000318B000-0x000000000318F000-memory.dmp

Filesize
16KB

Download
memory/1976-58-0x0000000000400000-0x0000000002F9E000-memory.dmp

Filesize
43.6MB

Download
memory/2024-60-0x0000000000000000-mapping.dmp

Download
memory/2024-62-0x00000000002CB000-0x00000000002CF000-memory.dmp

Filesize
16KB

Download
memory/2024-64-0x00000000002CB000-0x00000000002CF000-memory.dmp

Filesize
16KB

Download
memory/2024-65-0x0000000000400000-0x0000000002F9E000-memory.dmp

Filesize
43.6MB

Download

Analysis

Sharing