systembc | 9155fa1ea8c37176f6d3fc2438ac6217a4ca28ce279b510e9e7c1a89eb0f9800

Analysis

max time kernel
106s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-12-2022 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9702d33d65b6b24d32170f461240217.exe
Size

214KB
MD5

c9702d33d65b6b24d32170f461240217
SHA1

aacac19e5153e82e046b07e0c51b039e59bb4f66
SHA256

9155fa1ea8c37176f6d3fc2438ac6217a4ca28ce279b510e9e7c1a89eb0f9800
SHA512

e333a10e7015b978d8c74c7fad5beeaccbcc7e717aa06232f4729d81bc5973e0d72f6d067e5ffc2323ec849b58e1db95005923f37fe0c85fae9f13d54a6e262e
SSDEEP

6144:Ig72OD+LbR4/R/yIoqy9r0wUXXCU/M7dvaUQ/Hw14fZNw:j6Oo5Jr0wU9/oo/GMZi

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

scserv1.info:4077

scserv2.info:4077

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 2 IoCs

Processes:

uxsgiiu.exeuxsgiiu.exe

pid process

944 uxsgiiu.exe
1412 uxsgiiu.exe

pid	process
944	uxsgiiu.exe
1412	uxsgiiu.exe

Drops file in Windows directory 2 IoCs

Processes:

c9702d33d65b6b24d32170f461240217.exe

description	ioc	process
File created	C:\Windows\Tasks\uxsgiiu.job	c9702d33d65b6b24d32170f461240217.exe
File opened for modification	C:\Windows\Tasks\uxsgiiu.job	c9702d33d65b6b24d32170f461240217.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c9702d33d65b6b24d32170f461240217.exe

pid process

780 c9702d33d65b6b24d32170f461240217.exe

pid	process
780	c9702d33d65b6b24d32170f461240217.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 892 wrote to memory of 944	892	taskeng.exe	uxsgiiu.exe
PID 892 wrote to memory of 944	892	taskeng.exe	uxsgiiu.exe
PID 892 wrote to memory of 944	892	taskeng.exe	uxsgiiu.exe
PID 892 wrote to memory of 944	892	taskeng.exe	uxsgiiu.exe
PID 892 wrote to memory of 1412	892	taskeng.exe	uxsgiiu.exe
PID 892 wrote to memory of 1412	892	taskeng.exe	uxsgiiu.exe
PID 892 wrote to memory of 1412	892	taskeng.exe	uxsgiiu.exe
PID 892 wrote to memory of 1412	892	taskeng.exe	uxsgiiu.exe

C:\Users\Admin\AppData\Local\Temp\c9702d33d65b6b24d32170f461240217.exe
"C:\Users\Admin\AppData\Local\Temp\c9702d33d65b6b24d32170f461240217.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:780

C:\Windows\system32\taskeng.exe
taskeng.exe {F67BFBF2-3978-49E8-A428-E11197F6FD3D} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\ProgramData\kbgo\uxsgiiu.exe
C:\ProgramData\kbgo\uxsgiiu.exe start2
2⤵
- Executes dropped EXE
PID:944

C:\ProgramData\kbgo\uxsgiiu.exe
C:\ProgramData\kbgo\uxsgiiu.exe start2
2⤵
- Executes dropped EXE
PID:1412

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kbgo\uxsgiiu.exe
Filesize
214KB

MD5
c9702d33d65b6b24d32170f461240217

SHA1
aacac19e5153e82e046b07e0c51b039e59bb4f66

SHA256
9155fa1ea8c37176f6d3fc2438ac6217a4ca28ce279b510e9e7c1a89eb0f9800

SHA512
e333a10e7015b978d8c74c7fad5beeaccbcc7e717aa06232f4729d81bc5973e0d72f6d067e5ffc2323ec849b58e1db95005923f37fe0c85fae9f13d54a6e262e

Download Submit
C:\ProgramData\kbgo\uxsgiiu.exe
Filesize
214KB

MD5
c9702d33d65b6b24d32170f461240217

SHA1
aacac19e5153e82e046b07e0c51b039e59bb4f66

SHA256
9155fa1ea8c37176f6d3fc2438ac6217a4ca28ce279b510e9e7c1a89eb0f9800

SHA512
e333a10e7015b978d8c74c7fad5beeaccbcc7e717aa06232f4729d81bc5973e0d72f6d067e5ffc2323ec849b58e1db95005923f37fe0c85fae9f13d54a6e262e

Download Submit
C:\ProgramData\kbgo\uxsgiiu.exe
Filesize
214KB

MD5
c9702d33d65b6b24d32170f461240217

SHA1
aacac19e5153e82e046b07e0c51b039e59bb4f66

SHA256
9155fa1ea8c37176f6d3fc2438ac6217a4ca28ce279b510e9e7c1a89eb0f9800

SHA512
e333a10e7015b978d8c74c7fad5beeaccbcc7e717aa06232f4729d81bc5973e0d72f6d067e5ffc2323ec849b58e1db95005923f37fe0c85fae9f13d54a6e262e

Download Submit
memory/780-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/944-56-0x0000000000000000-mapping.dmp

Download
memory/1412-59-0x0000000000000000-mapping.dmp

Download