systembc | 451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6

Analysis

max time kernel
64s
max time network
145s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-09-2022 19:33

Target

451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe
Size

1.3MB
MD5

1cf1c28d832c5b1c26b80e1516d97591
SHA1

bcc5980cd4aedd24a4a2755b6d243a3a12a9bb0f
SHA256

451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6
SHA512

90b7cce549637028ca40664a5852519e37f43e090a2ee1d56b2079170ca4bfe2c94773703ef9dbf26129b287ba2b6dba4f6ec3417ef11264aee85c76e8c40206
SSDEEP

24576:doLyV5Hpv9tTHYNTLDXLGP4xhkcKjiD1rfYJTfDyjRC4zl:do0NZryLDXLGP4xJ+WjVZ

Score

10^/10

systembc trojan

Family

systembc

149.28.90.162:443

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe
File opened for modification	C:\Windows\Tasks\wow64.job	451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 896 wrote to memory of 1736	896	taskeng.exe	451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe
PID 896 wrote to memory of 1736	896	taskeng.exe	451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe
PID 896 wrote to memory of 1736	896	taskeng.exe	451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe
PID 896 wrote to memory of 1736	896	taskeng.exe	451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe

C:\Users\Admin\AppData\Local\Temp\451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe
"C:\Users\Admin\AppData\Local\Temp\451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe"
1⤵
- Drops file in Windows directory
PID:1832

C:\Windows\system32\taskeng.exe
taskeng.exe {C1793FD8-30EE-4A96-967B-6F7C462F715D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Local\Temp\451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe
C:\Users\Admin\AppData\Local\Temp\451b9b7832b6b30bd4835dfdc509638e56288279e5699a6321ee5adea5fc1ef6.exe start
2⤵
PID:1736

memory/1736-59-0x0000000000000000-mapping.dmp

Download
memory/1736-60-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/1736-62-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/1832-54-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/1832-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1832-56-0x0000000002E10000-0x0000000002EC0000-memory.dmp

Filesize
704KB

Download
memory/1832-57-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/1832-58-0x00000000003F0000-0x00000000003F5000-memory.dmp

Filesize
20KB

Download