Analysis

  • max time kernel
    228s
  • max time network
    291s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/11/2022, 04:17

General

  • Target

    3735585ffb3ec5d0493b3e3e44323ecb9ef11c78f8ccda56e2d86c02a103f736.exe

  • Size

    8.2MB

  • MD5

    8aaa63d32bc201244a89f771d37c5523

  • SHA1

    9f0b6da7824c11e18bfc67fef016dc4c6d034c6e

  • SHA256

    3735585ffb3ec5d0493b3e3e44323ecb9ef11c78f8ccda56e2d86c02a103f736

  • SHA512

    d75ef26bff91d50fe959a86f20db7813bf8fd6e16ac7d9b17b22401eab29841b60f79bbdd472a1fd29aff7b2f8c8a186f6baf5f29225deb7f879cb76208eaf76

  • SSDEEP

    98304:0nf7Zg7kBIjYXCz76QOph+F7ccTDhUCuEw3YtVD8flWyK40uLlcKLh+5D:U0jrf6QOph+LsyTyKruJV0D

Malware Config

Extracted

Family

systembc

C2

89.22.225.242:4193

195.2.93.22:4193

Signatures

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3735585ffb3ec5d0493b3e3e44323ecb9ef11c78f8ccda56e2d86c02a103f736.exe
    "C:\Users\Admin\AppData\Local\Temp\3735585ffb3ec5d0493b3e3e44323ecb9ef11c78f8ccda56e2d86c02a103f736.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\hohowoha felite pabor yawexe winebi quejita poveh vakor vavajofe gaso kit\hiwolos febocisi moq kadi.exe"
      2⤵
      • Creates scheduled task(s)
      PID:5072
    • C:\Users\Admin\hohowoha felite pabor yawexe winebi quejita poveh vakor vavajofe gaso kit\hiwolos febocisi moq kadi.exe
      "C:\Users\Admin\hohowoha felite pabor yawexe winebi quejita poveh vakor vavajofe gaso kit\hiwolos febocisi moq kadi.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Checks whether UAC is enabled
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        3⤵
          PID:4856
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\3735585ffb3ec5d0493b3e3e44323ecb9ef11c78f8ccda56e2d86c02a103f736.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          3⤵
            PID:4428
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1
            3⤵
            • Runs ping.exe
            PID:2844

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\mntemp

              Filesize

              16B

              MD5

              74b67ffc2d06bbc77a8ab989ed932c04

              SHA1

              60230f37be50ed8c592aedb0cdd7e344ceca2689

              SHA256

              76e755d18897a0991b938706181ac99cf4e7b16d7364214072de155189a38215

              SHA512

              a66f7ae45c15cc3a54d1212ec331f575d8589895f6e4a8626a8dfeffe8be66d62b3c26ab781bc6d3e61f738b1aa64259d60651456c4d3bf3afeed8bf17fd9e56

            • C:\Users\Admin\hohowoha felite pabor yawexe winebi quejita poveh vakor vavajofe gaso kit\hiwolos febocisi moq kadi.exe

              Filesize

              788.2MB

              MD5

              f6496055561efaea4cd6e57b7035a207

              SHA1

              8810a73467c8ea7c022be01c39161d73dc124629

              SHA256

              da069bc72528472bd28ad1b2c7dee95af3ff651267888a46e275642b6f02ae9d

              SHA512

              9c297ab117db052af08378b0da99007535b207dbc6263410494dd25ae2471137a0a0875509d679b2e31d58454c93392042106699d5c744124755360b3fe00280

            • C:\Users\Admin\hohowoha felite pabor yawexe winebi quejita poveh vakor vavajofe gaso kit\hiwolos febocisi moq kadi.exe

              Filesize

              788.2MB

              MD5

              f6496055561efaea4cd6e57b7035a207

              SHA1

              8810a73467c8ea7c022be01c39161d73dc124629

              SHA256

              da069bc72528472bd28ad1b2c7dee95af3ff651267888a46e275642b6f02ae9d

              SHA512

              9c297ab117db052af08378b0da99007535b207dbc6263410494dd25ae2471137a0a0875509d679b2e31d58454c93392042106699d5c744124755360b3fe00280

            • memory/3504-159-0x0000000003E58000-0x0000000003F48000-memory.dmp

              Filesize

              960KB

            • memory/3504-152-0x0000000000C10000-0x0000000001440000-memory.dmp

              Filesize

              8.2MB

            • memory/3504-169-0x0000000076EF0000-0x0000000077093000-memory.dmp

              Filesize

              1.6MB

            • memory/3504-170-0x0000000003E58000-0x0000000003F48000-memory.dmp

              Filesize

              960KB

            • memory/3504-168-0x0000000000C10000-0x0000000001440000-memory.dmp

              Filesize

              8.2MB

            • memory/3504-161-0x0000000011870000-0x00000000118D2000-memory.dmp

              Filesize

              392KB

            • memory/3504-160-0x0000000011870000-0x00000000118D2000-memory.dmp

              Filesize

              392KB

            • memory/3504-158-0x0000000003971000-0x0000000003E41000-memory.dmp

              Filesize

              4.8MB

            • memory/3504-157-0x0000000003E58000-0x0000000003F48000-memory.dmp

              Filesize

              960KB

            • memory/3504-156-0x0000000003971000-0x0000000003E41000-memory.dmp

              Filesize

              4.8MB

            • memory/3504-155-0x0000000000C10000-0x0000000001440000-memory.dmp

              Filesize

              8.2MB

            • memory/3504-153-0x0000000076EF0000-0x0000000077093000-memory.dmp

              Filesize

              1.6MB

            • memory/3504-150-0x0000000000C10000-0x0000000001440000-memory.dmp

              Filesize

              8.2MB

            • memory/4344-135-0x0000000003020000-0x00000000034F0000-memory.dmp

              Filesize

              4.8MB

            • memory/4344-136-0x00000000008A0000-0x00000000010D0000-memory.dmp

              Filesize

              8.2MB

            • memory/4344-139-0x0000000003020000-0x00000000034F0000-memory.dmp

              Filesize

              4.8MB

            • memory/4344-133-0x0000000076EF0000-0x0000000077093000-memory.dmp

              Filesize

              1.6MB

            • memory/4344-148-0x0000000003506000-0x00000000035F6000-memory.dmp

              Filesize

              960KB

            • memory/4344-147-0x0000000076EF0000-0x0000000077093000-memory.dmp

              Filesize

              1.6MB

            • memory/4344-146-0x00000000008A0000-0x00000000010D0000-memory.dmp

              Filesize

              8.2MB

            • memory/4344-138-0x0000000076EF0000-0x0000000077093000-memory.dmp

              Filesize

              1.6MB

            • memory/4344-132-0x00000000008A0000-0x00000000010D0000-memory.dmp

              Filesize

              8.2MB

            • memory/4344-134-0x00000000008A0000-0x00000000010D0000-memory.dmp

              Filesize

              8.2MB

            • memory/4344-137-0x0000000003506000-0x00000000035F6000-memory.dmp

              Filesize

              960KB

            • memory/4344-140-0x0000000003506000-0x00000000035F6000-memory.dmp

              Filesize

              960KB

            • memory/4856-163-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

            • memory/4856-165-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB

            • memory/4856-167-0x0000000000400000-0x0000000000407000-memory.dmp

              Filesize

              28KB