systembc | 8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-07-2024 13:07

Target

8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2.exe
Size

266KB
MD5

63b509f4565ff9a05402b2b18083b53a
SHA1

a0c3ba7679a36976bbbbad6c08758054ba49af8b
SHA256

8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2
SHA512

49463bd0b39e16855562aa7230a6868493bac6028e33809c109421def6a152bb6d803855521da106e40527f4a0fcf6995c7533e193e337e09aea6e7f9e363d10
SSDEEP

6144:yH8IVk4Zehh58aShksd29V0mN1s0fVyQaUvPQP/s:yHhBSh59uksd2ku1sqQQ+8

Score

10^/10

systembc trojan

Family

systembc

69.46.15.147:4001

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\wow64.job	8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2.exe
File created	C:\Windows\Tasks\wow64.job	8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2568	2856	taskeng.exe	29
PID 2856 wrote to memory of 2568	2856	taskeng.exe	29
PID 2856 wrote to memory of 2568	2856	taskeng.exe	29
PID 2856 wrote to memory of 2568	2856	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2.exe
"C:\Users\Admin\AppData\Local\Temp\8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2.exe"
1⤵
- Drops file in Windows directory
PID:2028

C:\Windows\system32\taskeng.exe
taskeng.exe {BF254AED-2641-448E-9635-E8A2FAF8F8E9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2.exe
  C:\Users\Admin\AppData\Local\Temp\8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2.exe start
  2⤵
  PID:2568

memory/2028-1-0x0000000002F90000-0x0000000003090000-memory.dmp

Filesize
1024KB

Download
memory/2028-3-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2028-2-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/2028-8-0x0000000000400000-0x0000000002DB8000-memory.dmp

Filesize
41.7MB

Download
memory/2028-10-0x0000000002F90000-0x0000000003090000-memory.dmp

Filesize
1024KB

Download
memory/2568-7-0x0000000000400000-0x0000000002DB8000-memory.dmp

Filesize
41.7MB

Download