systembc | e97ed984a81729c4a86b77a76fe20ced017bf751ef53dd98cc771e1c182d16ba

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-12-2022 19:33

Target

52b3d7c433249524d3b20050960b04b2.exe
Size

146KB
MD5

52b3d7c433249524d3b20050960b04b2
SHA1

df622a212fdc481c27a7c8ba3ee74e5067e12aaf
SHA256

e97ed984a81729c4a86b77a76fe20ced017bf751ef53dd98cc771e1c182d16ba
SHA512

5958e4f7e67601904ce69b4d01fd701dafa39b483fd49917d60264b55bddff416c3c8b1d9339bc18571bf09d8dd065ec03aa55893c5ac9990627fd6293c913a1
SSDEEP

3072:mA6iU08iyvwgfvpuYx+NX9cYhInaM71CMTgUktbO:mA6Yufvvx+NX9YxRjTgztb

Score

10^/10

systembc trojan

Family

systembc

45.182.189.231:443

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

rnja.exe

pid process

960 rnja.exe

pid	process
960	rnja.exe

Drops file in Windows directory 2 IoCs

Processes:

52b3d7c433249524d3b20050960b04b2.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\rnja.job	52b3d7c433249524d3b20050960b04b2.exe
File created	C:\Windows\Tasks\rnja.job	52b3d7c433249524d3b20050960b04b2.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

52b3d7c433249524d3b20050960b04b2.exe

pid process

1388 52b3d7c433249524d3b20050960b04b2.exe

pid	process
1388	52b3d7c433249524d3b20050960b04b2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1940 wrote to memory of 960	1940	taskeng.exe	rnja.exe
PID 1940 wrote to memory of 960	1940	taskeng.exe	rnja.exe
PID 1940 wrote to memory of 960	1940	taskeng.exe	rnja.exe
PID 1940 wrote to memory of 960	1940	taskeng.exe	rnja.exe

C:\Windows\system32\taskeng.exe
taskeng.exe {E3458DD6-8194-4C9E-B479-846191FECA7D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\ProgramData\iqgo\rnja.exe
C:\ProgramData\iqgo\rnja.exe start
2⤵
- Executes dropped EXE
PID:960

C:\ProgramData\iqgo\rnja.exe
Filesize
146KB

MD5
52b3d7c433249524d3b20050960b04b2

SHA1
df622a212fdc481c27a7c8ba3ee74e5067e12aaf

SHA256
e97ed984a81729c4a86b77a76fe20ced017bf751ef53dd98cc771e1c182d16ba

SHA512
5958e4f7e67601904ce69b4d01fd701dafa39b483fd49917d60264b55bddff416c3c8b1d9339bc18571bf09d8dd065ec03aa55893c5ac9990627fd6293c913a1

Download Submit
C:\ProgramData\iqgo\rnja.exe
Filesize
146KB

MD5
52b3d7c433249524d3b20050960b04b2

SHA1
df622a212fdc481c27a7c8ba3ee74e5067e12aaf

SHA256
e97ed984a81729c4a86b77a76fe20ced017bf751ef53dd98cc771e1c182d16ba

SHA512
5958e4f7e67601904ce69b4d01fd701dafa39b483fd49917d60264b55bddff416c3c8b1d9339bc18571bf09d8dd065ec03aa55893c5ac9990627fd6293c913a1

Download Submit
memory/960-59-0x0000000000000000-mapping.dmp

Download
memory/960-62-0x000000000075D000-0x000000000076E000-memory.dmp

Filesize
68KB

Download
memory/960-63-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/960-64-0x000000000075D000-0x000000000076E000-memory.dmp

Filesize
68KB

Download
memory/1388-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1388-55-0x0000000000A0D000-0x0000000000A1E000-memory.dmp

Filesize
68KB

Download
memory/1388-57-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download