systembc | bca33b43134eedcf263d6d7febd81775c71585873458884d0ce025cb348a7009

Analysis

max time kernel
132s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 17:46

Target

28135bb818682c71869768c1105e91595367c2f633c6e68b8c2ccb8611911972.exe
Size

16KB
MD5

ca36ad5442865e4b9571c82ce7b5bfe7
SHA1

b0b8795eb15b7986484c9f979c9d440f73b482e4
SHA256

28135bb818682c71869768c1105e91595367c2f633c6e68b8c2ccb8611911972
SHA512

50d702c68aa82d50a4b0f1a455f0a05c3d5eaa69ebe88fd001bfb349169fe1902be93ae282b5cdc650865fcdd91c5267fe6c9324da45dd14b467ea6854e13f1f
SSDEEP

384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dVJ3uM9s:r0gklrydgQP1yO67VJ3uMm

Score

10^/10

systembc trojan

Family

systembc

45.140.147.91:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Executes dropped EXE 2 IoCs

pid	Process
2552	xcuo.exe
2844	xcuo.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\xcuo.job	28135bb818682c71869768c1105e91595367c2f633c6e68b8c2ccb8611911972.exe
File opened for modification	C:\Windows\Tasks\xcuo.job	28135bb818682c71869768c1105e91595367c2f633c6e68b8c2ccb8611911972.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2528	28135bb818682c71869768c1105e91595367c2f633c6e68b8c2ccb8611911972.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2552	1836	taskeng.exe	29
PID 1836 wrote to memory of 2552	1836	taskeng.exe	29
PID 1836 wrote to memory of 2552	1836	taskeng.exe	29
PID 1836 wrote to memory of 2552	1836	taskeng.exe	29
PID 1836 wrote to memory of 2844	1836	taskeng.exe	32
PID 1836 wrote to memory of 2844	1836	taskeng.exe	32
PID 1836 wrote to memory of 2844	1836	taskeng.exe	32
PID 1836 wrote to memory of 2844	1836	taskeng.exe	32

C:\Windows\system32\taskeng.exe
taskeng.exe {265304AA-BFC0-4196-A033-6A4FE978AFD3} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\ProgramData\ciseoa\xcuo.exe
  C:\ProgramData\ciseoa\xcuo.exe start2
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\ProgramData\ciseoa\xcuo.exe
  C:\ProgramData\ciseoa\xcuo.exe start2
  2⤵
  - Executes dropped EXE
  PID:2844

C:\ProgramData\ciseoa\xcuo.exe

Filesize
16KB

MD5
ca36ad5442865e4b9571c82ce7b5bfe7

SHA1
b0b8795eb15b7986484c9f979c9d440f73b482e4

SHA256
28135bb818682c71869768c1105e91595367c2f633c6e68b8c2ccb8611911972

SHA512
50d702c68aa82d50a4b0f1a455f0a05c3d5eaa69ebe88fd001bfb349169fe1902be93ae282b5cdc650865fcdd91c5267fe6c9324da45dd14b467ea6854e13f1f

Download Submit