systembc | d9cd94b48ccedbd006ec0c6c3d24f0fe18fa60d7a20f90408acbc3617d37126b

Analysis

max time kernel
77s
max time network
98s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31-08-2022 08:13

Target

tmp.exe
Size

172KB
MD5

9f48a667f96c0cd55c6f6acd68976563
SHA1

87622ba459b912a040a3919cf5e4d4c6af7ff8dc
SHA256

d9cd94b48ccedbd006ec0c6c3d24f0fe18fa60d7a20f90408acbc3617d37126b
SHA512

1d804bcb07119118fed8a66a262dadab876ce5f09bc6d461159953d8edfe2da8659ec1fe0cfe7f112f17dba91cc7bb90863d66175be3df2841e098f4f75bb1ca
SSDEEP

3072:02g2ZW/HNmPagkh3DDptrONvMDn4lPdKvqVpB/Jmtk9cuvI:x8vCehzDnrDudKva/cic

Score

10^/10

systembc trojan

Family

systembc

193.106.191.168:4244

146.70.53.169:4244

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Drops file in Windows directory 2 IoCs

Processes:

tmp.exe

description ioc process

File created C:\Windows\Tasks\wow64.job tmp.exe
File opened for modification C:\Windows\Tasks\wow64.job tmp.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	tmp.exe
File opened for modification	C:\Windows\Tasks\wow64.job	tmp.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1312 wrote to memory of 952	1312	taskeng.exe	tmp.exe
PID 1312 wrote to memory of 952	1312	taskeng.exe	tmp.exe
PID 1312 wrote to memory of 952	1312	taskeng.exe	tmp.exe
PID 1312 wrote to memory of 952	1312	taskeng.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Drops file in Windows directory
PID:2004

C:\Windows\system32\taskeng.exe
taskeng.exe {3D101C27-5D9A-4817-ADFD-C8EF16804F04} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Users\Admin\AppData\Local\Temp\tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp.exe start
2⤵
PID:952

memory/952-58-0x0000000000000000-mapping.dmp

Download
memory/952-60-0x000000000290D000-0x000000000291D000-memory.dmp

Filesize
64KB

Download
memory/952-61-0x0000000000400000-0x00000000024AE000-memory.dmp

Filesize
32.7MB

Download
memory/2004-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x00000000002B0000-0x00000000002B5000-memory.dmp

Filesize
20KB

Download
memory/2004-55-0x000000000254D000-0x000000000255E000-memory.dmp

Filesize
68KB

Download
memory/2004-57-0x0000000000400000-0x00000000024AE000-memory.dmp

Filesize
32.7MB

Download