Malware Analysis Report

2025-04-03 09:22

Sample ID 250307-wpsk3at1as
Target cubrodriver.exe
SHA256 c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131
Tags
systembc defense_evasion discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131

Threat Level: Known bad

The file cubrodriver.exe was found to be: Known bad.

Malicious Activity Summary

systembc defense_evasion discovery trojan

SystemBC

Systembc family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Executes dropped EXE

Identifies Wine through registry keys

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-07 18:06

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-07 18:06

Reported

2025-03-07 18:08

Platform

win7-20240903-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\pnnppg\dpete.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\pnnppg\dpete.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\pnnppg\dpete.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\pnnppg\dpete.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine C:\ProgramData\pnnppg\dpete.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
N/A N/A C:\ProgramData\pnnppg\dpete.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\pnnppg\dpete.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
N/A N/A C:\ProgramData\pnnppg\dpete.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1792 wrote to memory of 2436 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\pnnppg\dpete.exe
PID 1792 wrote to memory of 2436 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\pnnppg\dpete.exe
PID 1792 wrote to memory of 2436 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\pnnppg\dpete.exe
PID 1792 wrote to memory of 2436 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\pnnppg\dpete.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe

"C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {18B489AB-A6D7-446D-8369-254E57B24742} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]

C:\ProgramData\pnnppg\dpete.exe

C:\ProgramData\pnnppg\dpete.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4086 towerbingobongoboom.com tcp

Files

memory/2716-0-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-1-0x00000000779F0000-0x00000000779F2000-memory.dmp

memory/2716-2-0x0000000000401000-0x0000000000403000-memory.dmp

memory/2716-4-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-6-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-7-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-8-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-9-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-10-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-11-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-12-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-13-0x0000000000400000-0x0000000000840000-memory.dmp

C:\ProgramData\pnnppg\dpete.exe

MD5 190272ebd2e82a80b242b1bdd442b859
SHA1 fceb12a205c28c30b2049c55924a9872a1a3eb71
SHA256 c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131
SHA512 f3b30d8ea2dd2c451a042b4ed7a9e98d2bcfbb86a88bec2d672a3e1ae6ab3932daf8987eef872e6adb11144f92b9954ac6f6ce67e24a2bc391d7b34ebef876ae

memory/2436-16-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-17-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 90a8fd508bbb57d9ff7a41fc77f6eba5
SHA1 dda06c2c9e1f8929091b8a4a90cf4cfcd70b9111
SHA256 df8f0b1900a3ccb967c2d6bbe178b266550a851780d32037d441e37021b8823b
SHA512 a3ef8301632b1b01098adfdf039d843f89c37e55a331295fa749f8b30cf99fb06973215e654b1eb5e536bafa2f709592626cd86d20806fd047f305ff9e32e076

memory/2436-19-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-20-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-21-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-22-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-23-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-24-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2716-25-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-26-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-27-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-28-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-29-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-30-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-31-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-32-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-33-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-34-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2436-35-0x0000000000400000-0x0000000000840000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-07 18:06

Reported

2025-03-07 18:08

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\mlld\shpfmi.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\mlld\shpfmi.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\mlld\shpfmi.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\mlld\shpfmi.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\ProgramData\mlld\shpfmi.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
N/A N/A C:\ProgramData\mlld\shpfmi.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\mlld\shpfmi.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe N/A
N/A N/A C:\ProgramData\mlld\shpfmi.exe N/A
N/A N/A C:\ProgramData\mlld\shpfmi.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe

"C:\Users\Admin\AppData\Local\Temp\cubrodriver.exe"

C:\ProgramData\mlld\shpfmi.exe

C:\ProgramData\mlld\shpfmi.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4151 towerbingobongoboom.com tcp

Files

memory/4516-0-0x0000000000400000-0x0000000000840000-memory.dmp

memory/4516-1-0x00000000778A4000-0x00000000778A6000-memory.dmp

memory/4516-2-0x0000000000401000-0x0000000000403000-memory.dmp

memory/4516-3-0x0000000000400000-0x0000000000840000-memory.dmp

memory/4516-6-0x0000000000400000-0x0000000000840000-memory.dmp

memory/4516-7-0x0000000000400000-0x0000000000840000-memory.dmp

memory/4516-8-0x0000000000400000-0x0000000000840000-memory.dmp

memory/4516-9-0x0000000000400000-0x0000000000840000-memory.dmp

memory/4516-10-0x0000000000400000-0x0000000000840000-memory.dmp

memory/4516-11-0x0000000000400000-0x0000000000840000-memory.dmp

C:\ProgramData\mlld\shpfmi.exe

MD5 190272ebd2e82a80b242b1bdd442b859
SHA1 fceb12a205c28c30b2049c55924a9872a1a3eb71
SHA256 c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131
SHA512 f3b30d8ea2dd2c451a042b4ed7a9e98d2bcfbb86a88bec2d672a3e1ae6ab3932daf8987eef872e6adb11144f92b9954ac6f6ce67e24a2bc391d7b34ebef876ae

memory/5032-14-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-15-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 f4c535447ca21666793e5f975d70dfe3
SHA1 c2931689d97fa59502540a1fc4207e8f3cdef260
SHA256 a4f6ed3925b1adda1d07788a6495e60d7a6aed2a7e41c3fe43575be8a4b760fd
SHA512 fc40bce69443035df4c1c6bf4b1c77c17fdc4083a201bccf0399d1fc9f8e0e6eced104e5bba121a66fc7057912a5572a5a7aa03d770c7eee26deaeb02c0f9d7e

memory/4516-17-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-18-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-19-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-20-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-21-0x0000000000400000-0x0000000000840000-memory.dmp

memory/4516-22-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-24-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-25-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-26-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-27-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-28-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-29-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-30-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-31-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5032-32-0x0000000000400000-0x0000000000840000-memory.dmp