Analysis
-
max time kernel
268s -
max time network
262s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-es -
resource tags
-
submitted
04-02-2025 16:28
General
-
Target
inputexp.exe
-
Size
1.6MB
-
MD5
c3069d373ad7ad584a38a1f8d192d795
-
SHA1
7622f9ba0222571b132b8cf4170cfbe9ef6c84e5
-
SHA256
7d6c86e5760cce346c1da56d5be37325370a33166077af261078aa7d32fdee78
-
SHA512
26dd481a8febddf3eafd7aab249c55440a1106b4250cc296aa0eea383973c7797757235ab3c69c0763361b23f612ffda3a926bab7ddacae777f0c9357682def8
-
SSDEEP
49152:D69hioTji28jbgm0K9qW8y9vPw3NeGlXKnnzYFplO6Kqe:D6PTTjzUPPZPqNpak5K
Malware Config
Extracted
systembc
wodresomdaymomentum.org:4001
-
dns
5.132.191.104
ns1.vic.au.dns.opennic.glue
ns2.vic.au.dns.opennic.glue
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Systembc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 2 IoCs
-
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\inputexp.exe"C:\Users\Admin\AppData\Local\Temp\inputexp.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\qmkigca\hntb.exeC:\ProgramData\qmkigca\hntb.exe start21⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\qmkigca\hntb.exeC:\ProgramData\qmkigca\hntb.exe start21⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5c3069d373ad7ad584a38a1f8d192d795
SHA17622f9ba0222571b132b8cf4170cfbe9ef6c84e5
SHA2567d6c86e5760cce346c1da56d5be37325370a33166077af261078aa7d32fdee78
SHA51226dd481a8febddf3eafd7aab249c55440a1106b4250cc296aa0eea383973c7797757235ab3c69c0763361b23f612ffda3a926bab7ddacae777f0c9357682def8
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB