Analysis
-
max time kernel
148s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
15-02-2025 16:56
General
-
Target
kzTq7Bt.exe
-
Size
1.7MB
-
MD5
35be87c37074612e552d655637c59a0f
-
SHA1
d97b62245300b82004df138404e1863f7923de5c
-
SHA256
d98d8488c405182e03c95b78692ca0bab65ade4838042aae4b3f0de662495ed3
-
SHA512
7c5862ce057d1b38c3ea836f78585efb4c6c914aea1ac5e2ac757525d33f092a3e4f76c7ae7433df3d4995d3bbe6fe99728653123dbcf5bcb1f8d20badab34fa
-
SSDEEP
49152:82DaBnPGGeftb0jn+yMVR6n9rMZzpornZoV:8LBP9ef9xrR6n9Ezpoq
Malware Config
Extracted
systembc
wodresomdaymomentum.org
-
dns
5.132.191.104
Signatures
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
Systembc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\kzTq7Bt.exe"C:\Users\Admin\AppData\Local\Temp\kzTq7Bt.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {9C2797CD-9A0E-462E-B83E-79F328867E26} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\kjldaxi\dlai.exeC:\ProgramData\kjldaxi\dlai.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD535be87c37074612e552d655637c59a0f
SHA1d97b62245300b82004df138404e1863f7923de5c
SHA256d98d8488c405182e03c95b78692ca0bab65ade4838042aae4b3f0de662495ed3
SHA5127c5862ce057d1b38c3ea836f78585efb4c6c914aea1ac5e2ac757525d33f092a3e4f76c7ae7433df3d4995d3bbe6fe99728653123dbcf5bcb1f8d20badab34fa
-
Filesize
218B
MD5d87ff677872df171aad08896bd92f96a
SHA17d827ad0b41c9e28026fe818e0f61fdc517f011b
SHA256e06bbf712e0480591e33213de9fc5a82231e4ce1c7b3d77f97f3e056388a178c
SHA512e4c545702d75a4e919f22c92608e3e965151ae18530fa79f8e631c32641a6eeaf7738e62a25c26f3e3d50c8f2c13ec38d56f98a94c56f59e2caa838955fa3784
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
8KB
-
Filesize
20KB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB