Analysis
-
max time kernel
116s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-02-2025 13:19
General
-
Target
52de774870c7ada6eed786f6d24840d1a59f7665d5b90c5029522ca35243623cN.exe
-
Size
1.6MB
-
MD5
0e577b56933e1ca5c34d2332a5c60a00
-
SHA1
9a16911a231aa1d88ed89869b4a705c3023225d4
-
SHA256
52de774870c7ada6eed786f6d24840d1a59f7665d5b90c5029522ca35243623c
-
SHA512
15b4f4910a90678c52b0790fe0a47017240dc70764c060e99a842b16b0f0230267467b0380a9ddf039de78e2c7b95db8d9d88ba67ac736975850ab00ebea6d81
-
SSDEEP
24576:EeuPfbQTsLQvDFzqllx+/IAFAeuoRq6DJ/CoT+scEcz4OBl0p/EJUhe7DdwIHXZI:DtOgdquInmfdCqjcG00pces7DfHX
Malware Config
Extracted
systembc
wodresomdaymomentum.org
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Systembc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\52de774870c7ada6eed786f6d24840d1a59f7665d5b90c5029522ca35243623cN.exe"C:\Users\Admin\AppData\Local\Temp\52de774870c7ada6eed786f6d24840d1a59f7665d5b90c5029522ca35243623cN.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {66B055CC-A702-4F5C-9F37-0F94DC1DB590} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\xrnrui\gqdt.exeC:\ProgramData\xrnrui\gqdt.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD50e577b56933e1ca5c34d2332a5c60a00
SHA19a16911a231aa1d88ed89869b4a705c3023225d4
SHA25652de774870c7ada6eed786f6d24840d1a59f7665d5b90c5029522ca35243623c
SHA51215b4f4910a90678c52b0790fe0a47017240dc70764c060e99a842b16b0f0230267467b0380a9ddf039de78e2c7b95db8d9d88ba67ac736975850ab00ebea6d81
-
Filesize
216B
MD5297530c4e68bb38a69e2933dd695eab2
SHA1e38bfa51ad8c339f21793e88ed6725a4843b619c
SHA2560ddb5782af4481ea02db1f4b8a38aec13c2d0ed8e9b6ff56d2ad96cad62e8c12
SHA51271ee88ebc7d03691a7eb84bc2e2b1d6e0570b7ee02b3ca92a7212b5b983976696472838ca262b00b7f94a76cf959d9bf7a184c38477a4828973a855e8c592cb9
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
8KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
8KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB