Malware Analysis Report

2025-04-03 09:22

Sample ID 250308-qw5lbaxxdz
Target c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe
SHA256 c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131
Tags
systembc defense_evasion discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131

Threat Level: Known bad

The file c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe was found to be: Known bad.

Malicious Activity Summary

systembc defense_evasion discovery trojan

SystemBC

Systembc family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Executes dropped EXE

Identifies Wine through registry keys

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-08 13:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-08 13:37

Reported

2025-03-08 13:40

Platform

win7-20240903-en

Max time kernel

141s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\lumic\xgoecc.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\lumic\xgoecc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\lumic\xgoecc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\lumic\xgoecc.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\ProgramData\lumic\xgoecc.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
N/A N/A C:\ProgramData\lumic\xgoecc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\lumic\xgoecc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
N/A N/A C:\ProgramData\lumic\xgoecc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2832 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\lumic\xgoecc.exe
PID 2832 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\lumic\xgoecc.exe
PID 2832 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\lumic\xgoecc.exe
PID 2832 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\lumic\xgoecc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe

"C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {8B5BCF8D-C98E-49BE-A99F-979F04F3AFCB} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]

C:\ProgramData\lumic\xgoecc.exe

C:\ProgramData\lumic\xgoecc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4086 towerbingobongoboom.com tcp

Files

memory/3020-0-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-1-0x0000000077700000-0x0000000077702000-memory.dmp

memory/3020-2-0x0000000000401000-0x0000000000403000-memory.dmp

memory/3020-4-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-6-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-7-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-8-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-9-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-10-0x0000000000400000-0x0000000000840000-memory.dmp

C:\ProgramData\lumic\xgoecc.exe

MD5 190272ebd2e82a80b242b1bdd442b859
SHA1 fceb12a205c28c30b2049c55924a9872a1a3eb71
SHA256 c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131
SHA512 f3b30d8ea2dd2c451a042b4ed7a9e98d2bcfbb86a88bec2d672a3e1ae6ab3932daf8987eef872e6adb11144f92b9954ac6f6ce67e24a2bc391d7b34ebef876ae

memory/2872-13-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-14-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 ea97085873ca3cb52f45fc8c35a6a3cf
SHA1 15d9a55d1be2dd6654e6b2da130680b5c8bf51a2
SHA256 8550c2231a1f6698ce7b609f4a4fb5616a6de6f957ffc9c47b4ae2f58b8724b2
SHA512 02c5fde1aeb10352604fa3a393a577b9a56b489244952da58aa955ceb716cab79e78af86f40b4d9a77e8e53066a882e197781b06f5517373aa17c16ef5fb3377

memory/2872-16-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-17-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-18-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-19-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-20-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-22-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-23-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-24-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-25-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-26-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3020-27-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-28-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-29-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-30-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-31-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-32-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-33-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-34-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-35-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-36-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2872-37-0x0000000000400000-0x0000000000840000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-08 13:37

Reported

2025-03-08 13:40

Platform

win10v2004-20250217-en

Max time kernel

142s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\tqhihp\nhectk.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\tqhihp\nhectk.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\tqhihp\nhectk.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\tqhihp\nhectk.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\ProgramData\tqhihp\nhectk.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
N/A N/A C:\ProgramData\tqhihp\nhectk.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\tqhihp\nhectk.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe

"C:\Users\Admin\AppData\Local\Temp\c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131.exe"

C:\ProgramData\tqhihp\nhectk.exe

C:\ProgramData\tqhihp\nhectk.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4151 towerbingobongoboom.com tcp

Files

memory/3472-0-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-1-0x0000000077CF4000-0x0000000077CF6000-memory.dmp

memory/3472-2-0x0000000000401000-0x0000000000403000-memory.dmp

memory/3472-3-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-6-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-7-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-8-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-9-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-10-0x0000000000400000-0x0000000000840000-memory.dmp

C:\ProgramData\tqhihp\nhectk.exe

MD5 190272ebd2e82a80b242b1bdd442b859
SHA1 fceb12a205c28c30b2049c55924a9872a1a3eb71
SHA256 c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131
SHA512 f3b30d8ea2dd2c451a042b4ed7a9e98d2bcfbb86a88bec2d672a3e1ae6ab3932daf8987eef872e6adb11144f92b9954ac6f6ce67e24a2bc391d7b34ebef876ae

memory/3692-13-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-14-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 3e5c085fcacf1349eba8d44f57ee227b
SHA1 cf08f069527092f1308b7a7b94d8d27d683b4f93
SHA256 8dd77eb2b4b2b5fecbbf4819021e9621c3aceceeebc80a69ea045e6cffe23646
SHA512 09f3b15a3803a4b154c3d5b541e3b1704765697f1fe54b35a697767bad1a870fe27c0bb280b76d41e482dd4e77d00baec4ce7a0312fc4408859d99452d9c13f6

memory/3692-16-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-17-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-18-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-19-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-20-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-21-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-22-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-23-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-24-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-25-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3472-27-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-28-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-29-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-30-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-31-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-32-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-33-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-34-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-35-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3692-36-0x0000000000400000-0x0000000000840000-memory.dmp