systembc | e53dc87e496e8b9e798419bbbdc6ab953d7f1d08a54546cb3b2aabced1b88bed

Analysis

max time kernel
145s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-05-2023 05:40

Target

ad08584c525066f399a30dd03f4ca596.exe
Size

77KB
MD5

ad08584c525066f399a30dd03f4ca596
SHA1

ced14e862f8bb80de80c11bc02b4e4d4a0834389
SHA256

e53dc87e496e8b9e798419bbbdc6ab953d7f1d08a54546cb3b2aabced1b88bed
SHA512

40d435cd785280e6dd6dd3eb914da9249fe8a11fd7ecc78b1a3672de3843e9efd39676d898af8bb0cf376e50c6c7d91f2df8081d94906437e611e5ca87bd2ae8
SSDEEP

1536:mRxiXCIQg7XVSynL5C9b7OLYRVSUqoWG4zbVwxStmMgc:I4ZQg7FSyL5gb7GCzqNG4dNxgc

Score

10^/10

systembc trojan upx

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

epwsf.exe

pid process

672 epwsf.exe

pid	process
672	epwsf.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1992-54-0x0000000000400000-0x000000000044E000-memory.dmp	upx
C:\ProgramData\xtwk\epwsf.exe	upx
C:\ProgramData\xtwk\epwsf.exe	upx

Drops file in Windows directory 2 IoCs

Processes:

ad08584c525066f399a30dd03f4ca596.exe

description	ioc	process
File created	C:\Windows\Tasks\corolina17.job	ad08584c525066f399a30dd03f4ca596.exe
File opened for modification	C:\Windows\Tasks\corolina17.job	ad08584c525066f399a30dd03f4ca596.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ad08584c525066f399a30dd03f4ca596.exe

pid process

1992 ad08584c525066f399a30dd03f4ca596.exe

pid	process
1992	ad08584c525066f399a30dd03f4ca596.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 760 wrote to memory of 672	760	taskeng.exe	epwsf.exe
PID 760 wrote to memory of 672	760	taskeng.exe	epwsf.exe
PID 760 wrote to memory of 672	760	taskeng.exe	epwsf.exe
PID 760 wrote to memory of 672	760	taskeng.exe	epwsf.exe

C:\Windows\system32\taskeng.exe
taskeng.exe {022FA3E9-ADF9-466B-8CF7-E401E8DE2404} S-1-5-21-1914912747-3343861975-731272777-1000:TMRJMUQF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\ProgramData\xtwk\epwsf.exe
C:\ProgramData\xtwk\epwsf.exe start2
2⤵
- Executes dropped EXE
PID:672

C:\ProgramData\xtwk\epwsf.exe

Filesize
77KB

MD5
ad08584c525066f399a30dd03f4ca596

SHA1
ced14e862f8bb80de80c11bc02b4e4d4a0834389

SHA256
e53dc87e496e8b9e798419bbbdc6ab953d7f1d08a54546cb3b2aabced1b88bed

SHA512
40d435cd785280e6dd6dd3eb914da9249fe8a11fd7ecc78b1a3672de3843e9efd39676d898af8bb0cf376e50c6c7d91f2df8081d94906437e611e5ca87bd2ae8

Download Submit
C:\ProgramData\xtwk\epwsf.exe

Filesize
77KB

MD5
ad08584c525066f399a30dd03f4ca596

SHA1
ced14e862f8bb80de80c11bc02b4e4d4a0834389

SHA256
e53dc87e496e8b9e798419bbbdc6ab953d7f1d08a54546cb3b2aabced1b88bed

SHA512
40d435cd785280e6dd6dd3eb914da9249fe8a11fd7ecc78b1a3672de3843e9efd39676d898af8bb0cf376e50c6c7d91f2df8081d94906437e611e5ca87bd2ae8

Download Submit
memory/672-69-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1992-54-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1992-55-0x00000000002B0000-0x00000000002B4000-memory.dmp

Filesize
16KB

Download
memory/1992-56-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download