systembc | cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 10:41

Target

cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe
Size

16KB
MD5

c661a77c31f83c413a96b5537ad31989
SHA1

8a5a47e39a9efa9dc4de447d2ae4cd5e375e3557
SHA256

cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1
SHA512

b86e45d36d8566b51f932f660ee9c3d79cea1a2eb34a9f7da7b2ccc5e50c74f319e8005e43d719c5722ec148ddddf1351a7f9edc430888e572b3884d1610b1aa
SSDEEP

384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V

Score

10^/10

systembc trojan

Family

systembc

clwtumberaero.cyou:4001

185.43.220.45:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 2 IoCs

Processes:

mbqhdn.exembqhdn.exe

pid process

2680 mbqhdn.exe
1776 mbqhdn.exe

pid	process
2680	mbqhdn.exe
1776	mbqhdn.exe

Drops file in Windows directory 2 IoCs

Processes:

cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\mbqhdn.job	cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe
File created	C:\Windows\Tasks\mbqhdn.job	cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe

pid process

2084 cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe

pid	process
2084	cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 3040 wrote to memory of 2680	3040	taskeng.exe	mbqhdn.exe
PID 3040 wrote to memory of 2680	3040	taskeng.exe	mbqhdn.exe
PID 3040 wrote to memory of 2680	3040	taskeng.exe	mbqhdn.exe
PID 3040 wrote to memory of 2680	3040	taskeng.exe	mbqhdn.exe
PID 3040 wrote to memory of 1776	3040	taskeng.exe	mbqhdn.exe
PID 3040 wrote to memory of 1776	3040	taskeng.exe	mbqhdn.exe
PID 3040 wrote to memory of 1776	3040	taskeng.exe	mbqhdn.exe
PID 3040 wrote to memory of 1776	3040	taskeng.exe	mbqhdn.exe

C:\Windows\system32\taskeng.exe
taskeng.exe {72257ED4-C7D8-4F24-856D-F97762F14D3F} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\ProgramData\gntcjfq\mbqhdn.exe
  C:\ProgramData\gntcjfq\mbqhdn.exe start2
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\ProgramData\gntcjfq\mbqhdn.exe
  C:\ProgramData\gntcjfq\mbqhdn.exe start2
  2⤵
  - Executes dropped EXE
  PID:1776

C:\ProgramData\gntcjfq\mbqhdn.exe

Filesize
16KB

MD5
c661a77c31f83c413a96b5537ad31989

SHA1
8a5a47e39a9efa9dc4de447d2ae4cd5e375e3557

SHA256
cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1

SHA512
b86e45d36d8566b51f932f660ee9c3d79cea1a2eb34a9f7da7b2ccc5e50c74f319e8005e43d719c5722ec148ddddf1351a7f9edc430888e572b3884d1610b1aa

Download Submit