systembc | 7880b2cd5384bf7c1c094d871947504df1eef7f29befa93fec72bbafc4fa8fa8

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 06:02

Target

7880b2cd5384bf7c1c094d871947504df1eef7f29befa93fec72bbafc4fa8fa8.exe
Size

250KB
MD5

a2235dca8dc46a22f9be08fedc7b1b0a
SHA1

9071d6d0cd331694ffb6b1caedf8b49de4728d70
SHA256

7880b2cd5384bf7c1c094d871947504df1eef7f29befa93fec72bbafc4fa8fa8
SHA512

ea3b517af5d1c93f6e020116259f5a550f4e00614d54ee43a784b1ffa0be767bd6d36e72328079a4b634d92a45f63f27796a9d51357114356174d0845d624a4b
SSDEEP

6144:Y6qM6mqNbnX+cd8rgyzZ/zNwZuX80fMBZ009:BemqxnX+cd8rgOhquX80fMBZV9

Score

10^/10

systembc trojan

Family

systembc

146.70.101.95:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 1 IoCs

pid	Process
1420	rfsvk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rfsvk.job	7880b2cd5384bf7c1c094d871947504df1eef7f29befa93fec72bbafc4fa8fa8.exe
File opened for modification	C:\Windows\Tasks\rfsvk.job	7880b2cd5384bf7c1c094d871947504df1eef7f29befa93fec72bbafc4fa8fa8.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1048	7880b2cd5384bf7c1c094d871947504df1eef7f29befa93fec72bbafc4fa8fa8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1420	952	taskeng.exe	28
PID 952 wrote to memory of 1420	952	taskeng.exe	28
PID 952 wrote to memory of 1420	952	taskeng.exe	28
PID 952 wrote to memory of 1420	952	taskeng.exe	28

C:\Windows\system32\taskeng.exe
taskeng.exe {6F23E221-23CA-48E0-9A31-7BE46EF8E335} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\ProgramData\dvqj\rfsvk.exe
  C:\ProgramData\dvqj\rfsvk.exe start
  2⤵
  - Executes dropped EXE
  PID:1420

C:\ProgramData\dvqj\rfsvk.exe

Filesize
250KB

MD5
a2235dca8dc46a22f9be08fedc7b1b0a

SHA1
9071d6d0cd331694ffb6b1caedf8b49de4728d70

SHA256
7880b2cd5384bf7c1c094d871947504df1eef7f29befa93fec72bbafc4fa8fa8

SHA512
ea3b517af5d1c93f6e020116259f5a550f4e00614d54ee43a784b1ffa0be767bd6d36e72328079a4b634d92a45f63f27796a9d51357114356174d0845d624a4b

Download Submit
C:\ProgramData\dvqj\rfsvk.exe

Filesize
250KB

MD5
a2235dca8dc46a22f9be08fedc7b1b0a

SHA1
9071d6d0cd331694ffb6b1caedf8b49de4728d70

SHA256
7880b2cd5384bf7c1c094d871947504df1eef7f29befa93fec72bbafc4fa8fa8

SHA512
ea3b517af5d1c93f6e020116259f5a550f4e00614d54ee43a784b1ffa0be767bd6d36e72328079a4b634d92a45f63f27796a9d51357114356174d0845d624a4b

Download Submit
memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1048-55-0x000000000069B000-0x00000000006AC000-memory.dmp

Filesize
68KB

Download
memory/1048-56-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1048-57-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1048-64-0x000000000069B000-0x00000000006AC000-memory.dmp

Filesize
68KB

Download
memory/1420-62-0x00000000006CB000-0x00000000006DC000-memory.dmp

Filesize
68KB

Download
memory/1420-63-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1420-65-0x00000000006CB000-0x00000000006DC000-memory.dmp

Filesize
68KB

Download