Malware Analysis Report

2025-06-15 21:58

Sample ID 221112-2hphqahg75
Target efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1
SHA256 efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1
Tags
systembc evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1

Threat Level: Known bad

The file efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1 was found to be: Known bad.

Malicious Activity Summary

systembc evasion trojan

SystemBC

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Executes dropped EXE

Checks BIOS information in registry

Identifies Wine through registry keys

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-12 22:35

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-12 22:35

Reported

2022-11-12 22:40

Platform

win7-20220901-en

Max time kernel

175s

Max time network

245s

Command Line

"C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe"

Signatures

SystemBC

trojan systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\pciu\miwkdja.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\pciu\miwkdja.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\pciu\miwkdja.exe N/A
N/A N/A C:\ProgramData\pciu\miwkdja.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\pciu\miwkdja.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\pciu\miwkdja.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\pciu\miwkdja.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\pciu\miwkdja.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine C:\ProgramData\pciu\miwkdja.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine C:\ProgramData\pciu\miwkdja.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
N/A N/A C:\ProgramData\pciu\miwkdja.exe N/A
N/A N/A C:\ProgramData\pciu\miwkdja.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Tasks\miwkdja.job C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
File created C:\Windows\Tasks\miwkdja.job C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe

"C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {3F9217A9-93B4-4CE1-9931-AD3DCE7E5A62} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]

C:\ProgramData\pciu\miwkdja.exe

C:\ProgramData\pciu\miwkdja.exe start2

C:\ProgramData\pciu\miwkdja.exe

C:\ProgramData\pciu\miwkdja.exe start2

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 cryptotab.me udp
N/A 23.94.163.16:4001 cryptotab.me tcp

Files

memory/1380-54-0x0000000000400000-0x00000000009C3000-memory.dmp

memory/1380-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

memory/1380-56-0x0000000077210000-0x0000000077390000-memory.dmp

memory/1380-57-0x0000000000400000-0x00000000009C3000-memory.dmp

C:\ProgramData\pciu\miwkdja.exe

MD5 3aad6e79569fcc68f0b8530225e08743
SHA1 e1247952bedea6d68c471b779d673167d5e1d774
SHA256 efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1
SHA512 b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d

memory/1484-59-0x0000000000000000-mapping.dmp

C:\ProgramData\pciu\miwkdja.exe

MD5 3aad6e79569fcc68f0b8530225e08743
SHA1 e1247952bedea6d68c471b779d673167d5e1d774
SHA256 efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1
SHA512 b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d

memory/1484-61-0x0000000000400000-0x00000000009C3000-memory.dmp

memory/1380-62-0x0000000077210000-0x0000000077390000-memory.dmp

memory/1484-64-0x0000000000400000-0x00000000009C3000-memory.dmp

memory/1380-65-0x0000000077210000-0x0000000077390000-memory.dmp

memory/1484-66-0x0000000077210000-0x0000000077390000-memory.dmp

memory/1272-67-0x0000000000000000-mapping.dmp

C:\ProgramData\pciu\miwkdja.exe

MD5 3aad6e79569fcc68f0b8530225e08743
SHA1 e1247952bedea6d68c471b779d673167d5e1d774
SHA256 efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1
SHA512 b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d

memory/1272-69-0x0000000000400000-0x00000000009C3000-memory.dmp

memory/1272-71-0x0000000077210000-0x0000000077390000-memory.dmp

memory/1272-72-0x0000000000400000-0x00000000009C3000-memory.dmp

memory/1272-73-0x0000000077210000-0x0000000077390000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-12 22:35

Reported

2022-11-12 22:40

Platform

win10-20220812-en

Max time kernel

173s

Max time network

302s

Command Line

"C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe"

Signatures

SystemBC

trojan systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\ewxi\lgna.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\ewxi\lgna.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\ewxi\lgna.exe N/A
N/A N/A C:\ProgramData\ewxi\lgna.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\ewxi\lgna.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\ewxi\lgna.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\ewxi\lgna.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\ewxi\lgna.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine C:\ProgramData\ewxi\lgna.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine C:\ProgramData\ewxi\lgna.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
N/A N/A C:\ProgramData\ewxi\lgna.exe N/A
N/A N/A C:\ProgramData\ewxi\lgna.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\lgna.job C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A
File opened for modification C:\Windows\Tasks\lgna.job C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe

"C:\Users\Admin\AppData\Local\Temp\efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1.exe"

C:\ProgramData\ewxi\lgna.exe

C:\ProgramData\ewxi\lgna.exe start2

C:\ProgramData\ewxi\lgna.exe

C:\ProgramData\ewxi\lgna.exe start2

Network

Country Destination Domain Proto
N/A 52.178.17.3:443 tcp
N/A 87.248.202.1:80 tcp
N/A 8.8.8.8:53 cryptotab.me udp
N/A 23.94.163.16:4001 cryptotab.me tcp

Files

memory/2700-116-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-117-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-118-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-119-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-120-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-121-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-122-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-123-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-125-0x0000000000400000-0x00000000009C3000-memory.dmp

memory/2700-126-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-124-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-127-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-128-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-130-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-129-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-131-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-132-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-133-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-134-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-135-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-136-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-137-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-138-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-139-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-140-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-141-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-142-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-143-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-144-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-145-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-146-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-147-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-148-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-149-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-150-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-151-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-152-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-153-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-154-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-155-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-156-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-157-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-158-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-159-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-162-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-161-0x0000000000400000-0x00000000009C3000-memory.dmp

memory/2700-160-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-163-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-165-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-164-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-166-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-167-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-168-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/2700-169-0x0000000077840000-0x00000000779CE000-memory.dmp

C:\ProgramData\ewxi\lgna.exe

MD5 3aad6e79569fcc68f0b8530225e08743
SHA1 e1247952bedea6d68c471b779d673167d5e1d774
SHA256 efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1
SHA512 b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d

memory/4728-171-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-172-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-173-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-174-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-175-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-176-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-177-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-180-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-179-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-181-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-182-0x0000000077840000-0x00000000779CE000-memory.dmp

memory/4728-183-0x0000000077840000-0x00000000779CE000-memory.dmp

C:\ProgramData\ewxi\lgna.exe

MD5 3aad6e79569fcc68f0b8530225e08743
SHA1 e1247952bedea6d68c471b779d673167d5e1d774
SHA256 efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1
SHA512 b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d

memory/4728-185-0x0000000000400000-0x00000000009C3000-memory.dmp

memory/4728-215-0x0000000000400000-0x00000000009C3000-memory.dmp

C:\ProgramData\ewxi\lgna.exe

MD5 3aad6e79569fcc68f0b8530225e08743
SHA1 e1247952bedea6d68c471b779d673167d5e1d774
SHA256 efb2b92a9ad40fb2d039fed04162ec421d3fd4bcd86adedbcb52d03ed5b742c1
SHA512 b30938d0210f9864f1165348f7bdbc1b6732687e8ee4a013b2c53f0ca0d212f8722cc8c6c4c187645f04d614cf2a21707869812c04ff551057f4d969141ab50d

memory/4168-225-0x0000000000400000-0x00000000009C3000-memory.dmp

memory/4168-258-0x0000000000400000-0x00000000009C3000-memory.dmp