systembc | 922ceb1d012920ad840955075cde0d92829d179d67e7116ebb97b61214d1b537

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 05:39

Target

0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe
Size

275KB
MD5

218976414ca64c87d927e0e02e928228
SHA1

d7cfb79d350bb5b13ec78a8b34a9cc2f05eabf93
SHA256

0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae
SHA512

e52af220c6339722a0f520ba42646a18ec1911f7c4bfcf9043eae74c2e5f95a77bdd683010cf1a6378eac0e49312bb1a2e70ffa5e5082c1572a0a29454008af0
SSDEEP

6144:DpjrIOKLD/HU9SNqvkCGY0GG9dY5zbmIc+8aSVj2e:1jreLTHq6qvkCGY0GG9dubm5+8Vjz

Score

10^/10

systembc trojan

Family

systembc

45.147.231.86:4254

146.70.53.169:4254

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\wow64.job	0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe
File created	C:\Windows\Tasks\wow64.job	0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 2664	1332	taskeng.exe	29
PID 1332 wrote to memory of 2664	1332	taskeng.exe	29
PID 1332 wrote to memory of 2664	1332	taskeng.exe	29
PID 1332 wrote to memory of 2664	1332	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe
"C:\Users\Admin\AppData\Local\Temp\0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe"
1⤵
- Drops file in Windows directory
PID:3020

C:\Windows\system32\taskeng.exe
taskeng.exe {E8213AC5-AD36-440D-8C5A-6D36E8EA1A67} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Users\Admin\AppData\Local\Temp\0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe
  C:\Users\Admin\AppData\Local\Temp\0f9f03bf486e3823a6ad596d4c1bd707fe19031acc0d17a3138409c8f3ee89ae.exe start
  2⤵
  PID:2664

memory/2664-9-0x0000000000400000-0x0000000000847000-memory.dmp

Filesize
4.3MB

Download
memory/2664-8-0x00000000001B0000-0x00000000001B5000-memory.dmp

Filesize
20KB

Download
memory/2664-7-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/3020-1-0x0000000000990000-0x0000000000A90000-memory.dmp

Filesize
1024KB

Download
memory/3020-2-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/3020-4-0x0000000000400000-0x0000000000847000-memory.dmp

Filesize
4.3MB

Download
memory/3020-10-0x0000000000990000-0x0000000000A90000-memory.dmp

Filesize
1024KB

Download