systembc | 6cab23262c6b7e07f2f240d85e6d8fee01bd0b1feed26690c465eefb81e44556

Analysis

max time kernel
140s
max time network
153s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 09:03

Target

60e1470a488cf3f51280225494b01f89.exe
Size

32KB
MD5

60e1470a488cf3f51280225494b01f89
SHA1

10a6a7d6f71505c3ac5e7b84602aae6aeff5476d
SHA256

6cab23262c6b7e07f2f240d85e6d8fee01bd0b1feed26690c465eefb81e44556
SHA512

f63cc031a09ada8a5989c28b9987098ebb935a76a448f70dcf7e73477880f7ce76568553df99e95c3460c9427fd80ac6e403c832ecabd1362d67a0c89435e620
SSDEEP

768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2zKc6oFg:YLJ8dayaaupDobnpo24i

Score

10^/10

systembc trojan

Family

systembc

89.248.163.188:443

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

pjokcog.exe

pid process

2020 pjokcog.exe

pid	process
2020	pjokcog.exe

Drops file in Windows directory 2 IoCs

Processes:

60e1470a488cf3f51280225494b01f89.exe

description	ioc	process
File created	C:\Windows\Tasks\pjokcog.job	60e1470a488cf3f51280225494b01f89.exe
File opened for modification	C:\Windows\Tasks\pjokcog.job	60e1470a488cf3f51280225494b01f89.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

60e1470a488cf3f51280225494b01f89.exe

pid process

1428 60e1470a488cf3f51280225494b01f89.exe

pid	process
1428	60e1470a488cf3f51280225494b01f89.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1512 wrote to memory of 2020	1512	taskeng.exe	pjokcog.exe
PID 1512 wrote to memory of 2020	1512	taskeng.exe	pjokcog.exe
PID 1512 wrote to memory of 2020	1512	taskeng.exe	pjokcog.exe
PID 1512 wrote to memory of 2020	1512	taskeng.exe	pjokcog.exe

C:\Windows\system32\taskeng.exe
taskeng.exe {2E4B8E40-AFF3-4391-83FF-85D315FF696F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\ProgramData\ccpe\pjokcog.exe
C:\ProgramData\ccpe\pjokcog.exe start
2⤵
- Executes dropped EXE
PID:2020

C:\ProgramData\ccpe\pjokcog.exe

Filesize
32KB

MD5
60e1470a488cf3f51280225494b01f89

SHA1
10a6a7d6f71505c3ac5e7b84602aae6aeff5476d

SHA256
6cab23262c6b7e07f2f240d85e6d8fee01bd0b1feed26690c465eefb81e44556

SHA512
f63cc031a09ada8a5989c28b9987098ebb935a76a448f70dcf7e73477880f7ce76568553df99e95c3460c9427fd80ac6e403c832ecabd1362d67a0c89435e620

Download Submit
C:\ProgramData\ccpe\pjokcog.exe

Filesize
32KB

MD5
60e1470a488cf3f51280225494b01f89

SHA1
10a6a7d6f71505c3ac5e7b84602aae6aeff5476d

SHA256
6cab23262c6b7e07f2f240d85e6d8fee01bd0b1feed26690c465eefb81e44556

SHA512
f63cc031a09ada8a5989c28b9987098ebb935a76a448f70dcf7e73477880f7ce76568553df99e95c3460c9427fd80ac6e403c832ecabd1362d67a0c89435e620

Download Submit
memory/1428-54-0x0000000074C41000-0x0000000074C43000-memory.dmp

Filesize
8KB

Download
memory/2020-56-0x0000000000000000-mapping.dmp

Download