systembc | 1e809bb5f85026c31ca54558e986ef87304252f48c354546c74f214c4b443e86

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 16:38

Target

08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f.exe
Size

16KB
MD5

365f7ff51ec4583ba6a426b15981b9e7
SHA1

2d66a5b213ec43165d0ccaea3a4b9e1bcdd68318
SHA256

08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f
SHA512

7eaa4ca6097b883156dfdcd0fea3c9b18520e8d431665551beae2e1c1e3e104671007ba83cde826fc025f931bfe1d74dc35de0ed184e59dfc9cb6c0b7822cf70
SSDEEP

384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V

Score

10^/10

systembc trojan

Family

systembc

193.233.21.140:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 2 IoCs

pid	Process
2256	qcri.exe
2000	qcri.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\qcri.job	08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f.exe
File opened for modification	C:\Windows\Tasks\qcri.job	08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2256	2204	taskeng.exe	29
PID 2204 wrote to memory of 2256	2204	taskeng.exe	29
PID 2204 wrote to memory of 2256	2204	taskeng.exe	29
PID 2204 wrote to memory of 2256	2204	taskeng.exe	29
PID 2204 wrote to memory of 2000	2204	taskeng.exe	32
PID 2204 wrote to memory of 2000	2204	taskeng.exe	32
PID 2204 wrote to memory of 2000	2204	taskeng.exe	32
PID 2204 wrote to memory of 2000	2204	taskeng.exe	32

C:\Windows\system32\taskeng.exe
taskeng.exe {1306C29E-18E0-4817-B949-4641537DDDE3} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\ProgramData\laov\qcri.exe
  C:\ProgramData\laov\qcri.exe start2
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\ProgramData\laov\qcri.exe
  C:\ProgramData\laov\qcri.exe start2
  2⤵
  - Executes dropped EXE
  PID:2000

C:\ProgramData\laov\qcri.exe

Filesize
16KB

MD5
365f7ff51ec4583ba6a426b15981b9e7

SHA1
2d66a5b213ec43165d0ccaea3a4b9e1bcdd68318

SHA256
08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f

SHA512
7eaa4ca6097b883156dfdcd0fea3c9b18520e8d431665551beae2e1c1e3e104671007ba83cde826fc025f931bfe1d74dc35de0ed184e59dfc9cb6c0b7822cf70

Download Submit