systembc | 8cd25f3890b83cca1983424be8866191f6cdc63006e9d7b84d97c333cb4d149a

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 12:45

Target
socks.exe
Size 16KB
Sample240105-py1vgacbfp
SHA256 8cd25f3890b83cca1983424be8866191f6cdc63006e9d7b84d97c333cb4d149a
MD5 cc64f95a4208489ff4d7e00d84ef92c5
SHA1 7d8a4bf93e558db774ccf9054cfc72825df9e9cc
SHA512 97b0ef4f04e107f470a5387e732392cb583a4a5bc13289fcf4770a10b881bcf33741f64d4766321e3b1c04441c5a7327a32e542f53f584e6760b3434ea50152d
SSDEEP 384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc trojan

Family

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 2 IoCs

pid	Process
1980	vcawl.exe
1276	vcawl.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\vcawl.job	socks.exe
File opened for modification	C:\Windows\Tasks\vcawl.job	socks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2060	socks.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1980	3008	taskeng.exe	29
PID 3008 wrote to memory of 1980	3008	taskeng.exe	29
PID 3008 wrote to memory of 1980	3008	taskeng.exe	29
PID 3008 wrote to memory of 1980	3008	taskeng.exe	29
PID 3008 wrote to memory of 1276	3008	taskeng.exe	32
PID 3008 wrote to memory of 1276	3008	taskeng.exe	32
PID 3008 wrote to memory of 1276	3008	taskeng.exe	32
PID 3008 wrote to memory of 1276	3008	taskeng.exe	32

C:\Windows\system32\taskeng.exe
taskeng.exe {685DB271-6B36-42D3-9C32-C6CA2EA540B9} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\ProgramData\oesi\vcawl.exe
  C:\ProgramData\oesi\vcawl.exe start2
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\ProgramData\oesi\vcawl.exe
  C:\ProgramData\oesi\vcawl.exe start2
  2⤵
  - Executes dropped EXE
  PID:1276

vcawl.exe

Path C:\ProgramData\oesi\vcawl.exe
Size 16KB
SHA256 8cd25f3890b83cca1983424be8866191f6cdc63006e9d7b84d97c333cb4d149a
MD5 cc64f95a4208489ff4d7e00d84ef92c5
SHA1 7d8a4bf93e558db774ccf9054cfc72825df9e9cc
SHA512 97b0ef4f04e107f470a5387e732392cb583a4a5bc13289fcf4770a10b881bcf33741f64d4766321e3b1c04441c5a7327a32e542f53f584e6760b3434ea50152d
SSDEEP 384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V
MD5 SHA1 SHA512 SSDEEP

Submit Download