systembc | 0bb78df6c8e049c7a33d2656555e15388a59ee96bde6f221ac5494b959cd60eb

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-05-2023 04:53

Target

socks_tor.exe
Size

32KB
MD5

af6bc46db7a4d4ab3f4689848de18ddc
SHA1

5e00ccab03314b6c37a0a16f646fb13b8d1072ab
SHA256

c671384b86b7a99d4328402936f51ca9143543f8e6f715c8315e18d2e3c660e6
SHA512

81260938cc4b68cd61ed496ba99a873b2abdce7a57f27f9cbdab2acd1e70cade3acb394f0a2da01e4a3935deccf1b4006f550c38c2dbc1c4f2c19ad22a04250c
SSDEEP

768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2TZKc6wFg:YLJ8dayaaupDobnpo2wZu

Score

10^/10

systembc trojan

Family

systembc

89.248.163.188:443

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 1 IoCs

Processes:

qubhfv.exe

pid process

1072 qubhfv.exe
Drops file in Windows directory 2 IoCs

Processes:

socks_tor.exe

description ioc process

File created C:\Windows\Tasks\qubhfv.job socks_tor.exe
File opened for modification C:\Windows\Tasks\qubhfv.job socks_tor.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

socks_tor.exe

pid process

1332 socks_tor.exe

pid	process
1072	qubhfv.exe

description	ioc	process
File created	C:\Windows\Tasks\qubhfv.job	socks_tor.exe
File opened for modification	C:\Windows\Tasks\qubhfv.job	socks_tor.exe

pid	process
1332	socks_tor.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 876 wrote to memory of 1072	876	taskeng.exe	qubhfv.exe
PID 876 wrote to memory of 1072	876	taskeng.exe	qubhfv.exe
PID 876 wrote to memory of 1072	876	taskeng.exe	qubhfv.exe
PID 876 wrote to memory of 1072	876	taskeng.exe	qubhfv.exe

C:\Windows\system32\taskeng.exe
taskeng.exe {0EB00309-617C-44A3-A3A7-DE92157A424E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:876

C:\ProgramData\xkosgj\qubhfv.exe
C:\ProgramData\xkosgj\qubhfv.exe start
2⤵
- Executes dropped EXE
PID:1072

C:\ProgramData\xkosgj\qubhfv.exe

Filesize
32KB

MD5
af6bc46db7a4d4ab3f4689848de18ddc

SHA1
5e00ccab03314b6c37a0a16f646fb13b8d1072ab

SHA256
c671384b86b7a99d4328402936f51ca9143543f8e6f715c8315e18d2e3c660e6

SHA512
81260938cc4b68cd61ed496ba99a873b2abdce7a57f27f9cbdab2acd1e70cade3acb394f0a2da01e4a3935deccf1b4006f550c38c2dbc1c4f2c19ad22a04250c

Download Submit
C:\ProgramData\xkosgj\qubhfv.exe

Filesize
32KB

MD5
af6bc46db7a4d4ab3f4689848de18ddc

SHA1
5e00ccab03314b6c37a0a16f646fb13b8d1072ab

SHA256
c671384b86b7a99d4328402936f51ca9143543f8e6f715c8315e18d2e3c660e6

SHA512
81260938cc4b68cd61ed496ba99a873b2abdce7a57f27f9cbdab2acd1e70cade3acb394f0a2da01e4a3935deccf1b4006f550c38c2dbc1c4f2c19ad22a04250c

Download Submit