vjw0rm | e3f3d8e11b4dcac7bc9f7ba3e88659ecfabe9e03b42c9728ff01d1ee73ba0261

General

Target

Invoice remittance 52286.js
Size

317KB
MD5

c0fd4d06d9d01680a307ffcf75355352
SHA1

2daeb72092e39bcf668815ab472c6010436f5e47
SHA256

e3f3d8e11b4dcac7bc9f7ba3e88659ecfabe9e03b42c9728ff01d1ee73ba0261
SHA512

0ee84815dd36fb7ffbe5d07427fb0c2849795b50be115fa92b813ba823f8c7d4a2031f1d2c70ccd02cb148fe3106e0a8dc5d804162de0007fa7155b92e984f74

Score

10^/10

vjw0rm xloader n64d loader persistence rat suricata trojan worm

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

n64d

C2

http://www.bughtmisly.com/n64d/

Decoy

hayominta.com

dunstabzug.website

fafmediagroup.com

keepamericagreatagain-again.com

15jizhi.com

hachiden.net

manifestarz.com

bridgeschc.com

floving.com

tintaalairelibre.com

ditsawong.com

dabanse.com

choiceschristianliving.com

pcojapan-online.com

unityinsport.com

hersvin.com

suhaizat.com

vitaliyvs.com

equipmunks.com

yfhzx.com

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\bin.exe	xloader
C:\Users\Admin\AppData\Roaming\bin.exe	xloader
behavioral2/memory/2716-125-0x0000000001200000-0x0000000001228000-memory.dmp	xloader

Blocklisted process makes network request 19 IoCs

Processes:

wscript.execmstp.exe

flow	pid	process
9	1676	wscript.exe
13	1676	wscript.exe
17	1676	wscript.exe
18	1676	wscript.exe
23	1676	wscript.exe
26	1676	wscript.exe
30	1676	wscript.exe
34	1676	wscript.exe
37	1676	wscript.exe
42	1676	wscript.exe
45	1676	wscript.exe
50	1676	wscript.exe
51	1676	wscript.exe
52	1676	wscript.exe
56	2716	cmstp.exe
57	1676	wscript.exe
60	1676	wscript.exe
62	1676	wscript.exe
64	1676	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

bin.exe

pid process

2288 bin.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\abQJTxmwNy.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\abQJTxmwNy.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\abQJTxmwNy.js\""	wscript.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bin.execmstp.exe

description	pid	process	target process
PID 2288 set thread context of 3024	2288	bin.exe	Explorer.EXE
PID 2716 set thread context of 3024	2716	cmstp.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

bin.execmstp.exe

pid	process
2288	bin.exe
2288	bin.exe
2288	bin.exe
2288	bin.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe
2716	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3024 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

bin.execmstp.exe

pid process

2288 bin.exe
2288 bin.exe
2288 bin.exe
2716 cmstp.exe
2716 cmstp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bin.execmstp.exe

description pid process

Token: SeDebugPrivilege 2288 bin.exe
Token: SeDebugPrivilege 2716 cmstp.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3024 Explorer.EXE

pid	process
3024	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2288	bin.exe
Token: SeDebugPrivilege	2716	cmstp.exe

pid	process
3024	Explorer.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

wscript.exeExplorer.EXEcmstp.exe

description	pid	process	target process
PID 3628 wrote to memory of 1676	3628	wscript.exe	wscript.exe
PID 3628 wrote to memory of 1676	3628	wscript.exe	wscript.exe
PID 3628 wrote to memory of 2288	3628	wscript.exe	bin.exe
PID 3628 wrote to memory of 2288	3628	wscript.exe	bin.exe
PID 3628 wrote to memory of 2288	3628	wscript.exe	bin.exe
PID 3024 wrote to memory of 2716	3024	Explorer.EXE	cmstp.exe
PID 3024 wrote to memory of 2716	3024	Explorer.EXE	cmstp.exe
PID 3024 wrote to memory of 2716	3024	Explorer.EXE	cmstp.exe
PID 2716 wrote to memory of 184	2716	cmstp.exe	cmd.exe
PID 2716 wrote to memory of 184	2716	cmstp.exe	cmd.exe
PID 2716 wrote to memory of 184	2716	cmstp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Invoice remittance 52286.js"
2⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\abQJTxmwNy.js"
3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1676

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Roaming\bin.exe"
3⤵
PID:184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\abQJTxmwNy.js
MD5
3f7b92769fc59d8adc125b4d4e8adee4

SHA1
b3ea6913dcf3681572a1db1f429cc5e1e49b060e

SHA256
e1fccde6528046c2c1e41096085c199efaddc1393d42f6696165aeec43c9a209

SHA512
659caad97e885af9d5f2dece465873b517fc34a5c67f5f0aba08b9ef868cca57fe025ed9979bd0933e46ee45792d5b424bd99a24c4449c5b739f17e0b6bdf01f

Download Submit
C:\Users\Admin\AppData\Roaming\bin.exe
MD5
79d02002f7841dceae1bc53186c94b67

SHA1
3bf5dc0017d1239d962a80d48236c785b56cb78a

SHA256
251a226acb74675f4650739fd13adb1c1b468e53936ccc6385dbbdacb5220ade

SHA512
abc48c2c32ef4eef177c9904fd162cf65c98fe180e2435c3e9fd22506a400eb43f576a7731de02fc50dcfdafc59047695c4b1e74d8863e1c58c422ad7363a17e

Download Submit
C:\Users\Admin\AppData\Roaming\bin.exe
MD5
79d02002f7841dceae1bc53186c94b67

SHA1
3bf5dc0017d1239d962a80d48236c785b56cb78a

SHA256
251a226acb74675f4650739fd13adb1c1b468e53936ccc6385dbbdacb5220ade

SHA512
abc48c2c32ef4eef177c9904fd162cf65c98fe180e2435c3e9fd22506a400eb43f576a7731de02fc50dcfdafc59047695c4b1e74d8863e1c58c422ad7363a17e

Download Submit
memory/184-123-0x0000000000000000-mapping.dmp

Download
memory/1676-114-0x0000000000000000-mapping.dmp

Download
memory/2288-116-0x0000000000000000-mapping.dmp

Download
memory/2288-119-0x0000000001550000-0x0000000001870000-memory.dmp

Filesize
3.1MB

Download
memory/2288-120-0x0000000001260000-0x0000000001270000-memory.dmp

Filesize
64KB

Download
memory/2716-122-0x0000000000000000-mapping.dmp

Download
memory/2716-124-0x0000000001240000-0x0000000001256000-memory.dmp

Filesize
88KB

Download
memory/2716-126-0x00000000047F0000-0x0000000004B10000-memory.dmp

Filesize
3.1MB

Download
memory/2716-125-0x0000000001200000-0x0000000001228000-memory.dmp

Filesize
160KB

Download
memory/2716-127-0x0000000004BA0000-0x0000000004C2F000-memory.dmp

Filesize
572KB

Download
memory/3024-121-0x00000000063D0000-0x0000000006541000-memory.dmp

Filesize
1.4MB

Download
memory/3024-128-0x0000000006050000-0x00000000060FE000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads