systembc | fa8e172b009885380bc12629b0047a0e271da693b0cfb4679130cef7488fcdff

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-05-2023 15:40

Target

CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe
Size

426KB
MD5

fffab099edb70d514b4f7e71814a4b6b
SHA1

f883e7aed96e924295f133307cb9e75f6370b96c
SHA256

fa8e172b009885380bc12629b0047a0e271da693b0cfb4679130cef7488fcdff
SHA512

ecdbf9973ae32953a6b4b64a6d845f35e771ad03f69c387f3039c083bc4d35cb34c59f0f38f96e22c6333c30973f0c0711b837ba9a2a2eab3433a2e39b7baff2
SSDEEP

12288:Rn1Yckqq4kiIR4XInytR1Rhu0clrPrXEq8j:R1nS4f/X4aR1R3cDrXEq

Score

10^/10

systembc trojan

Family

systembc

178.79.174.207:443

146.70.53.169:443

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

Processes:

CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\wow64.job	CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe
File created	C:\Windows\Tasks\wow64.job	CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 1692 wrote to memory of 1772	1692	taskeng.exe	CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe
PID 1692 wrote to memory of 1772	1692	taskeng.exe	CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe
PID 1692 wrote to memory of 1772	1692	taskeng.exe	CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe
PID 1692 wrote to memory of 1772	1692	taskeng.exe	CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe

C:\Users\Admin\AppData\Local\Temp\CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe
"C:\Users\Admin\AppData\Local\Temp\CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe"
1⤵
- Drops file in Windows directory
PID:1580

C:\Windows\system32\taskeng.exe
taskeng.exe {2D25CFE2-ABD6-4D04-9355-FDD9A9219BCA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Users\Admin\AppData\Local\Temp\CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe
C:\Users\Admin\AppData\Local\Temp\CryptOne_Exec_3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc.exe start
2⤵
PID:1772

memory/1580-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1580-57-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1580-58-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1772-65-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1772-66-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download