systembc | 762609e4a697f34cbadaf4f6fbd1bcc5fc178eb51bba0854e97a2428202351a3

Analysis

max time kernel
146s
max time network
129s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-06-2023 01:00

Target

4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe
Size

263KB
MD5

00e2db89532040c67ffd107ce99200ff
SHA1

ecfa050c622f9a8937c241f4612b18e71a10b37f
SHA256

4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328
SHA512

e0db858ada8ab45ce009db7cdc3613496951cc9c27b68dec72586d68dbf605e43e9a4a616418710065a121046c8d03eb77b9131522677d1d1e527ce1b7e89b47
SSDEEP

3072:BgU/XdoE8Rk3EXyEx6lnortV5sEqirdUkx+uzyHvP0AwpRPfMvgpm9jDQi9j0dUR:WUVogdlqP5SLyyEVRPfMJQiUA

Score

10^/10

systembc trojan

Family

systembc

23.95.44.228:53

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 23.95.44.228

description	ioc
Destination IP	23.95.44.228

Drops file in Windows directory 2 IoCs

Processes:

4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe
File opened for modification	C:\Windows\Tasks\wow64.job	4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 528 wrote to memory of 628	528	taskeng.exe	4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe
PID 528 wrote to memory of 628	528	taskeng.exe	4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe
PID 528 wrote to memory of 628	528	taskeng.exe	4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe
PID 528 wrote to memory of 628	528	taskeng.exe	4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe

C:\Users\Admin\AppData\Local\Temp\4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe
"C:\Users\Admin\AppData\Local\Temp\4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe"
1⤵
- Drops file in Windows directory
PID:1764

C:\Windows\system32\taskeng.exe
taskeng.exe {F308618E-524A-42C2-81C6-448BC8226656} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Users\Admin\AppData\Local\Temp\4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe
C:\Users\Admin\AppData\Local\Temp\4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328.exe start
2⤵
PID:628

memory/628-66-0x0000000000400000-0x0000000002CE9000-memory.dmp

Filesize
40.9MB

Download
memory/1764-57-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/1764-58-0x0000000000400000-0x0000000002CE9000-memory.dmp

Filesize
40.9MB

Download