systembc | e1c088749ae4df16e4e029ecbc02b57c1a3ad3a36a3c5f1dfb9fd30f163f39df

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/12/2022, 14:05

Target
svchost.exe
Size 228KB
Sample221226-rdtxjada76
SHA256 e1c088749ae4df16e4e029ecbc02b57c1a3ad3a36a3c5f1dfb9fd30f163f39df
MD5 5bf69e555fe1e636d6c02c470bea0b6f
SHA1 96e30ea4c29b8eac021a17cc5cd056e269d9bfb0
SHA512 488caaca4b6b99de782d16a08ae8319b0c1a232a18bc2894d5e0c017af0764e1ffe4a32eb409d9cfde62f1e33b01306eb45bf285c9eaa653ca6d61c2f3b5edbd
SSDEEP 6144:ZbwPB/7O/FD4m+6I1/8Ni0u2VYOHT2C7u13ayTg:ZSOHT2C7uJVT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc trojan

Family

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\wow64.job	svchost.exe
File opened for modification	C:\Windows\Tasks\wow64.job	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1504	svchost.exe
1148	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1148	1176	taskeng.exe	28
PID 1176 wrote to memory of 1148	1176	taskeng.exe	28
PID 1176 wrote to memory of 1148	1176	taskeng.exe	28
PID 1176 wrote to memory of 1148	1176	taskeng.exe	28

C:\Windows\system32\taskeng.exe
taskeng.exe {FD2B322C-49C4-4765-883A-18C30F57B51A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe start
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1148

memory/1148-65-0x00000000003E0000-0x00000000003E7000-memory.dmp

Download

memory/1504-56-0x0000000075661000-0x0000000075663000-memory.dmp

Download

memory/1504-57-0x0000000000440000-0x0000000000447000-memory.dmp

Download