systembc | 038ace12ae9fa7016f5669faec6388a2d639ef45c8e9cdb774a72cb04fd2b7aa

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/04/2023, 01:19

Target
6fe218dea5435f56596a29a9d68614b9d4eb7615bb216897cced2d1aec586431.exe
Size 145KB
Sample230401-bpt4nsfa32
SHA256 6fe218dea5435f56596a29a9d68614b9d4eb7615bb216897cced2d1aec586431
MD5 44c9814d3dba7526300bfee720853ea2
SHA1 ec239ce6d39a144a7a78aa623298e756548f1634
SHA512 ba2991eebcee48d92a8fcc3dd783791d8c3dd523aa98b8bfe3909587692c848874d4d703a9277428465c6d37a66333dad71bc6efa949b824932fa4e1606e36bd
SSDEEP 3072:ETCKOJL9+xhMcgMUzcuNJ6G7V5bnqouw1NckiTdI4O:EO5L9AWzb6mqoT8v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc trojan

Family

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 1 IoCs

pid	Process
1716	ktaewbg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\ktaewbg.job	6fe218dea5435f56596a29a9d68614b9d4eb7615bb216897cced2d1aec586431.exe
File created	C:\Windows\Tasks\ktaewbg.job	6fe218dea5435f56596a29a9d68614b9d4eb7615bb216897cced2d1aec586431.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1476	6fe218dea5435f56596a29a9d68614b9d4eb7615bb216897cced2d1aec586431.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1716	1860	taskeng.exe	28
PID 1860 wrote to memory of 1716	1860	taskeng.exe	28
PID 1860 wrote to memory of 1716	1860	taskeng.exe	28
PID 1860 wrote to memory of 1716	1860	taskeng.exe	28

C:\Windows\system32\taskeng.exe
taskeng.exe {EE171BA0-746A-4B26-9155-73182868BB3B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\ProgramData\nvkhpc\ktaewbg.exe
  C:\ProgramData\nvkhpc\ktaewbg.exe start
  2⤵
  - Executes dropped EXE
  PID:1716

ktaewbg.exe

Path C:\ProgramData\nvkhpc\ktaewbg.exe
Size 145KB
SHA256 6fe218dea5435f56596a29a9d68614b9d4eb7615bb216897cced2d1aec586431
MD5 44c9814d3dba7526300bfee720853ea2
SHA1 ec239ce6d39a144a7a78aa623298e756548f1634
SHA512 ba2991eebcee48d92a8fcc3dd783791d8c3dd523aa98b8bfe3909587692c848874d4d703a9277428465c6d37a66333dad71bc6efa949b824932fa4e1606e36bd
SSDEEP 3072:ETCKOJL9+xhMcgMUzcuNJ6G7V5bnqouw1NckiTdI4O:EO5L9AWzb6mqoT8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

ktaewbg.exe

Path C:\ProgramData\nvkhpc\ktaewbg.exe
Size 145KB
SHA256 6fe218dea5435f56596a29a9d68614b9d4eb7615bb216897cced2d1aec586431
MD5 44c9814d3dba7526300bfee720853ea2
SHA1 ec239ce6d39a144a7a78aa623298e756548f1634
SHA512 ba2991eebcee48d92a8fcc3dd783791d8c3dd523aa98b8bfe3909587692c848874d4d703a9277428465c6d37a66333dad71bc6efa949b824932fa4e1606e36bd
SSDEEP 3072:ETCKOJL9+xhMcgMUzcuNJ6G7V5bnqouw1NckiTdI4O:EO5L9AWzb6mqoT8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1476-55-0x0000000000220000-0x0000000000229000-memory.dmp

Download

memory/1476-56-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/1716-70-0x0000000000400000-0x0000000000581000-memory.dmp

Download