systembc | d0f3211e3a351e4f7384243f983a33a0b4e989b61fea1e1c098bb5c8241ae102

Analysis

Target

tmp.exe
Size

239KB
MD5

546a938a34280d863ba416c0aacdb04e
SHA1

824f329cb115c4411d9651b029571f4759ac842e
SHA256

d0f3211e3a351e4f7384243f983a33a0b4e989b61fea1e1c098bb5c8241ae102
SHA512

46daabd195d7f5aa05a1345b5dcbc442388797348d2042e8ad3abc918a87467fca21dba2192e3c90d53984592ded2d6affb0d442b63bde5929a477ba51852287

Score

10^/10

systembc trojan

Family

systembc

62.182.82.33:1488

usaf.army:1488

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Drops file in Windows directory 2 IoCs

Processes:

tmp.exe

description ioc process

File opened for modification C:\Windows\Tasks\wow64.job tmp.exe
File created C:\Windows\Tasks\wow64.job tmp.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\wow64.job	tmp.exe
File created	C:\Windows\Tasks\wow64.job	tmp.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1288 wrote to memory of 2032	1288	taskeng.exe	tmp.exe
PID 1288 wrote to memory of 2032	1288	taskeng.exe	tmp.exe
PID 1288 wrote to memory of 2032	1288	taskeng.exe	tmp.exe
PID 1288 wrote to memory of 2032	1288	taskeng.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Drops file in Windows directory
PID:2016

C:\Windows\system32\taskeng.exe
taskeng.exe {19BD68C2-AE3B-4899-BB21-6287D3693A7D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\Temp\tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp.exe start
2⤵
PID:2032

memory/2016-54-0x00000000005EF000-0x00000000005F8000-memory.dmp

Filesize
36KB

Download
memory/2016-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x00000000005EF000-0x00000000005F8000-memory.dmp

Filesize
36KB

Download
memory/2016-57-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/2016-58-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2032-59-0x0000000000000000-mapping.dmp

Download
memory/2032-60-0x00000000004DF000-0x00000000004E8000-memory.dmp

Filesize
36KB

Download
memory/2032-62-0x00000000004DF000-0x00000000004E8000-memory.dmp

Filesize
36KB

Download
memory/2032-63-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download