systembc | d98d8488c405182e03c95b78692ca0bab65ade4838042aae4b3f0de662495ed3

General

Target

kzTq7Bt.exe
Size

1.7MB
MD5

35be87c37074612e552d655637c59a0f
SHA1

d97b62245300b82004df138404e1863f7923de5c
SHA256

d98d8488c405182e03c95b78692ca0bab65ade4838042aae4b3f0de662495ed3
SHA512

7c5862ce057d1b38c3ea836f78585efb4c6c914aea1ac5e2ac757525d33f092a3e4f76c7ae7433df3d4995d3bbe6fe99728653123dbcf5bcb1f8d20badab34fa
SSDEEP

49152:82DaBnPGGeftb0jn+yMVR6n9rMZzpornZoV:8LBP9ef9xrR6n9Ezpoq

Score

10^/10

systembc defense_evasion discovery trojan

Malware Config

Extracted

Family

systembc

C2

wodresomdaymomentum.org

Attributes

dns
5.132.191.104

Signatures

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Systembc family
systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	kzTq7Bt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	nlkla.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	kzTq7Bt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	kzTq7Bt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nlkla.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nlkla.exe

Executes dropped EXE 1 IoCs

pid	Process
2644	nlkla.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	kzTq7Bt.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	nlkla.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1980	kzTq7Bt.exe
2644	nlkla.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Test Task17.job	kzTq7Bt.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kzTq7Bt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlkla.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1980	kzTq7Bt.exe
2644	nlkla.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2644	1856	taskeng.exe	32
PID 1856 wrote to memory of 2644	1856	taskeng.exe	32
PID 1856 wrote to memory of 2644	1856	taskeng.exe	32
PID 1856 wrote to memory of 2644	1856	taskeng.exe	32

C:\Users\Admin\AppData\Local\Temp\kzTq7Bt.exe
"C:\Users\Admin\AppData\Local\Temp\kzTq7Bt.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1980

C:\Windows\system32\taskeng.exe
taskeng.exe {A9CCCE07-3871-49BB-8BBF-867985503090} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\ProgramData\mapgu\nlkla.exe
  C:\ProgramData\mapgu\nlkla.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mapgu\nlkla.exe

Filesize
1.7MB

MD5
35be87c37074612e552d655637c59a0f

SHA1
d97b62245300b82004df138404e1863f7923de5c

SHA256
d98d8488c405182e03c95b78692ca0bab65ade4838042aae4b3f0de662495ed3

SHA512
7c5862ce057d1b38c3ea836f78585efb4c6c914aea1ac5e2ac757525d33f092a3e4f76c7ae7433df3d4995d3bbe6fe99728653123dbcf5bcb1f8d20badab34fa

Download Submit
C:\Windows\Tasks\Test Task17.job

Filesize
216B

MD5
1a30932540dc5613fbd5eef13460572d

SHA1
fceddd05a7d0d730ddb51ca80a7e9402692302c0

SHA256
d3155f403b65fbda979207c69a631c8a50a09ce861b796f47c4d45f8984dd0f1

SHA512
0f9d531d92154f0b2eac6369f92b7d97c686ea8cee6814a9ca41e1bbe647bf8fe9e869e9adb8d27515a261d7fc46e24ab0835c8bf2e5fa2a60aea63e0e214650

Download Submit
memory/1980-19-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-6-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-4-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-7-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-8-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-9-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-10-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-11-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-12-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-1-0x0000000077BD0000-0x0000000077BD2000-memory.dmp

Filesize
8KB

Download
memory/1980-26-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-24-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-0-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1980-2-0x0000000000401000-0x0000000000406000-memory.dmp

Filesize
20KB

Download
memory/2644-22-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-30-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-21-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-29-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-36-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-15-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-28-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-18-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-16-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-27-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-31-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-32-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-33-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-34-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-35-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/2644-20-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads