systembc | 90840dc2454d579393366cb4cb9b5f813357b9ea3b9d1fb8fab4dfcd52ece396

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 07:49

Target

4f8e09e50fc6ba0df7ca60b8780f328f.exe
Size

32KB
MD5

4f8e09e50fc6ba0df7ca60b8780f328f
SHA1

07db534ca7469dcce60f3b0e5d3b10603034aa55
SHA256

90840dc2454d579393366cb4cb9b5f813357b9ea3b9d1fb8fab4dfcd52ece396
SHA512

84ea3e6d3ec25daa7e3e0dd8f2a056ccb85ea8b417e66cb9129b15892cb82cd89808797f30a030fe7f3ebfa39ea7c883d97753e7eecf62e2a7838e840327bc00
SSDEEP

768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2TZKc6zlFg:YLJ8dayaaupDobnpo2wZGo

Score

10^/10

systembc trojan

Family

systembc

89.248.163.218:443

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

fbxg.exe

pid process

1668 fbxg.exe

pid	process
1668	fbxg.exe

Drops file in Windows directory 2 IoCs

Processes:

4f8e09e50fc6ba0df7ca60b8780f328f.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\fbxg.job	4f8e09e50fc6ba0df7ca60b8780f328f.exe
File created	C:\Windows\Tasks\fbxg.job	4f8e09e50fc6ba0df7ca60b8780f328f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4f8e09e50fc6ba0df7ca60b8780f328f.exe

pid process

1864 4f8e09e50fc6ba0df7ca60b8780f328f.exe

pid	process
1864	4f8e09e50fc6ba0df7ca60b8780f328f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 2036 wrote to memory of 1668	2036	taskeng.exe	fbxg.exe
PID 2036 wrote to memory of 1668	2036	taskeng.exe	fbxg.exe
PID 2036 wrote to memory of 1668	2036	taskeng.exe	fbxg.exe
PID 2036 wrote to memory of 1668	2036	taskeng.exe	fbxg.exe

C:\Windows\system32\taskeng.exe
taskeng.exe {2D4558A8-3DCC-462F-ADAA-774CBB292B5C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\ProgramData\kona\fbxg.exe
C:\ProgramData\kona\fbxg.exe start
2⤵
- Executes dropped EXE
PID:1668

C:\ProgramData\kona\fbxg.exe
Filesize
32KB

MD5
4f8e09e50fc6ba0df7ca60b8780f328f

SHA1
07db534ca7469dcce60f3b0e5d3b10603034aa55

SHA256
90840dc2454d579393366cb4cb9b5f813357b9ea3b9d1fb8fab4dfcd52ece396

SHA512
84ea3e6d3ec25daa7e3e0dd8f2a056ccb85ea8b417e66cb9129b15892cb82cd89808797f30a030fe7f3ebfa39ea7c883d97753e7eecf62e2a7838e840327bc00

Download Submit
C:\ProgramData\kona\fbxg.exe
Filesize
32KB

MD5
4f8e09e50fc6ba0df7ca60b8780f328f

SHA1
07db534ca7469dcce60f3b0e5d3b10603034aa55

SHA256
90840dc2454d579393366cb4cb9b5f813357b9ea3b9d1fb8fab4dfcd52ece396

SHA512
84ea3e6d3ec25daa7e3e0dd8f2a056ccb85ea8b417e66cb9129b15892cb82cd89808797f30a030fe7f3ebfa39ea7c883d97753e7eecf62e2a7838e840327bc00

Download Submit
memory/1668-56-0x0000000000000000-mapping.dmp

Download
memory/1864-54-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download