systembc | cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 02:13

Target

cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe
Size

16KB
MD5

c661a77c31f83c413a96b5537ad31989
SHA1

8a5a47e39a9efa9dc4de447d2ae4cd5e375e3557
SHA256

cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1
SHA512

b86e45d36d8566b51f932f660ee9c3d79cea1a2eb34a9f7da7b2ccc5e50c74f319e8005e43d719c5722ec148ddddf1351a7f9edc430888e572b3884d1610b1aa
SSDEEP

384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V

Score

10^/10

systembc trojan

Family

systembc

clwtumberaero.cyou:4001

185.43.220.45:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Executes dropped EXE 2 IoCs

Processes:

vtaglq.exevtaglq.exe

pid process

2732 vtaglq.exe
348 vtaglq.exe

pid	process
2732	vtaglq.exe
348	vtaglq.exe

Drops file in Windows directory 2 IoCs

Processes:

cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe

description	ioc	process
File created	C:\Windows\Tasks\vtaglq.job	cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe
File opened for modification	C:\Windows\Tasks\vtaglq.job	cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe

pid process

2164 cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe

pid	process
2164	cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

taskeng.exe

description	pid	process	target process
PID 856 wrote to memory of 2732	856	taskeng.exe	vtaglq.exe
PID 856 wrote to memory of 2732	856	taskeng.exe	vtaglq.exe
PID 856 wrote to memory of 2732	856	taskeng.exe	vtaglq.exe
PID 856 wrote to memory of 2732	856	taskeng.exe	vtaglq.exe
PID 856 wrote to memory of 348	856	taskeng.exe	vtaglq.exe
PID 856 wrote to memory of 348	856	taskeng.exe	vtaglq.exe
PID 856 wrote to memory of 348	856	taskeng.exe	vtaglq.exe
PID 856 wrote to memory of 348	856	taskeng.exe	vtaglq.exe

C:\Windows\system32\taskeng.exe
taskeng.exe {6F5BF438-31D6-4F52-B483-099E98347D9C} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\ProgramData\mbhwt\vtaglq.exe
  C:\ProgramData\mbhwt\vtaglq.exe start2
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\ProgramData\mbhwt\vtaglq.exe
  C:\ProgramData\mbhwt\vtaglq.exe start2
  2⤵
  - Executes dropped EXE
  PID:348

C:\ProgramData\mbhwt\vtaglq.exe

Filesize
16KB

MD5
c661a77c31f83c413a96b5537ad31989

SHA1
8a5a47e39a9efa9dc4de447d2ae4cd5e375e3557

SHA256
cc5bb638cb34cbd386a906b7708eb62e05e3fc991a20bd060e1d84f722d29ff1

SHA512
b86e45d36d8566b51f932f660ee9c3d79cea1a2eb34a9f7da7b2ccc5e50c74f319e8005e43d719c5722ec148ddddf1351a7f9edc430888e572b3884d1610b1aa

Download Submit