Analysis
-
max time kernel
125s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 21:59
Behavioral task
behavioral1
Sample
XWorm V3.1 .exe
Resource
win7-20230220-en
General
-
Target
XWorm V3.1 .exe
-
Size
10.1MB
-
MD5
320526ae9b5dbd99a38d158578c84ccb
-
SHA1
60daf13da5fa663c1e7e67ac113fbb5859264b8c
-
SHA256
91a8aec23ab8e79172c8d7cbf6a733e73157941687eb58e8ffa543b7e721b7ea
-
SHA512
5c62082634d4abc4bc524b268c5bcf476f6a900cba8becc49e143c8b207f0f661e921a26a62df746236f65a9978b7691e541283835056c9c5a6efac0a382cf0f
-
SSDEEP
196608:ih0Avmh7fFbZyD3nvCEg+xyZTEQkM1V8/6zCSR6lGCUOGJ1PldRBo+zoDmAYU:iq1pbqdg+yZTUaCkZXOqdbS
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
AsyncMutex_7SI8OkPnk
-
delay
3
-
install
true
-
install_file
ContainerRuntime.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/Kb8rTgY7
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\svchost.exe asyncrat C:\Users\Admin\AppData\Local\Temp\svchost.exe asyncrat C:\Users\Admin\AppData\Local\Temp\svchost.exe asyncrat behavioral2/memory/1716-158-0x0000000000010000-0x0000000000026000-memory.dmp asyncrat behavioral2/memory/4404-168-0x000000001D8A0000-0x000000001D8B0000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
XWorm V3.1 .exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XWorm V3.1 .exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
XWorm V3.1 .exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XWorm V3.1 .exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XWorm V3.1 .exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XWorm V3.1 .exesvchost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation XWorm V3.1 .exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 3 IoCs
Processes:
XWorm V3.1.exesvchost.exeContainerRuntime.exepid process 4404 XWorm V3.1.exe 1716 svchost.exe 2968 ContainerRuntime.exe -
Processes:
resource yara_rule behavioral2/memory/4232-136-0x0000000000BD0000-0x0000000001B38000-memory.dmp themida behavioral2/memory/4232-137-0x0000000000BD0000-0x0000000001B38000-memory.dmp themida behavioral2/memory/4232-166-0x0000000000BD0000-0x0000000001B38000-memory.dmp themida -
Processes:
XWorm V3.1 .exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XWorm V3.1 .exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
XWorm V3.1 .exepid process 4232 XWorm V3.1 .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 100 timeout.exe 1392 timeout.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
svchost.exeContainerRuntime.exepid process 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 2968 ContainerRuntime.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
XWorm V3.1.exesvchost.exeContainerRuntime.exedescription pid process Token: SeDebugPrivilege 4404 XWorm V3.1.exe Token: SeDebugPrivilege 1716 svchost.exe Token: SeDebugPrivilege 2968 ContainerRuntime.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ContainerRuntime.exepid process 2968 ContainerRuntime.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
XWorm V3.1 .execmd.exesvchost.execmd.execmd.exedescription pid process target process PID 4232 wrote to memory of 4404 4232 XWorm V3.1 .exe XWorm V3.1.exe PID 4232 wrote to memory of 4404 4232 XWorm V3.1 .exe XWorm V3.1.exe PID 4232 wrote to memory of 1716 4232 XWorm V3.1 .exe svchost.exe PID 4232 wrote to memory of 1716 4232 XWorm V3.1 .exe svchost.exe PID 4232 wrote to memory of 1716 4232 XWorm V3.1 .exe svchost.exe PID 4232 wrote to memory of 4032 4232 XWorm V3.1 .exe cmd.exe PID 4232 wrote to memory of 4032 4232 XWorm V3.1 .exe cmd.exe PID 4232 wrote to memory of 4032 4232 XWorm V3.1 .exe cmd.exe PID 4032 wrote to memory of 100 4032 cmd.exe timeout.exe PID 4032 wrote to memory of 100 4032 cmd.exe timeout.exe PID 4032 wrote to memory of 100 4032 cmd.exe timeout.exe PID 1716 wrote to memory of 4820 1716 svchost.exe cmd.exe PID 1716 wrote to memory of 4820 1716 svchost.exe cmd.exe PID 1716 wrote to memory of 4820 1716 svchost.exe cmd.exe PID 1716 wrote to memory of 3700 1716 svchost.exe cmd.exe PID 1716 wrote to memory of 3700 1716 svchost.exe cmd.exe PID 1716 wrote to memory of 3700 1716 svchost.exe cmd.exe PID 3700 wrote to memory of 1392 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1392 3700 cmd.exe timeout.exe PID 3700 wrote to memory of 1392 3700 cmd.exe timeout.exe PID 4820 wrote to memory of 3848 4820 cmd.exe schtasks.exe PID 4820 wrote to memory of 3848 4820 cmd.exe schtasks.exe PID 4820 wrote to memory of 3848 4820 cmd.exe schtasks.exe PID 3700 wrote to memory of 2968 3700 cmd.exe ContainerRuntime.exe PID 3700 wrote to memory of 2968 3700 cmd.exe ContainerRuntime.exe PID 3700 wrote to memory of 2968 3700 cmd.exe ContainerRuntime.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 .exe"C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 .exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9DCB.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp87D2.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Local\Temp\tmp87D2.tmp.batFilesize
163B
MD58a5484a503dc0f7ea8e970b700d8c195
SHA12f85155453ee62c627a136a271fc6a4c2bc81dd9
SHA256ec22a57ce3fd2c251cbae204a40b5b2f1302218208dd403ff52457c295377701
SHA5128c395ec02276e2a54a773f9a0144e33edb6e68ad37911c50cea67b1dfd94c468aad90f673c29d862ad6c0beb1017ceb2ee9caed016d7781de00ca50165894b8b
-
C:\Users\Admin\AppData\Local\Temp\tmp9DCB.tmp.batFilesize
160B
MD5c94e1f33cc53a12c2fb4cfde7b13499f
SHA1c970ce9e3b39c621672f7534eeed8561b64c972a
SHA256493a8b5d7a6f13cf9f0438c0853f3f77bc1bb9dff26917195b5ef13decf2854f
SHA512ed5b9f87a731bf9c3de4100d07e1aa1b6e1cfb770613a2a7e01a7a86720121c57fb60afe1eb02caf8e624120507b3af144b4ffb58009d83672e4fb674b1162db
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
memory/1716-158-0x0000000000010000-0x0000000000026000-memory.dmpFilesize
88KB
-
memory/2968-184-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/2968-182-0x0000000005DC0000-0x0000000005DCA000-memory.dmpFilesize
40KB
-
memory/2968-181-0x0000000005B80000-0x0000000005C12000-memory.dmpFilesize
584KB
-
memory/4232-166-0x0000000000BD0000-0x0000000001B38000-memory.dmpFilesize
15.4MB
-
memory/4232-136-0x0000000000BD0000-0x0000000001B38000-memory.dmpFilesize
15.4MB
-
memory/4232-133-0x0000000000BD0000-0x0000000001B38000-memory.dmpFilesize
15.4MB
-
memory/4232-137-0x0000000000BD0000-0x0000000001B38000-memory.dmpFilesize
15.4MB
-
memory/4232-138-0x0000000006250000-0x00000000062EC000-memory.dmpFilesize
624KB
-
memory/4232-161-0x0000000006A80000-0x0000000007024000-memory.dmpFilesize
5.6MB
-
memory/4404-168-0x000000001D8A0000-0x000000001D8B0000-memory.dmpFilesize
64KB
-
memory/4404-171-0x000000001D8A0000-0x000000001D8B0000-memory.dmpFilesize
64KB
-
memory/4404-180-0x000000001D8A0000-0x000000001D8B0000-memory.dmpFilesize
64KB
-
memory/4404-183-0x000000001D8A0000-0x000000001D8B0000-memory.dmpFilesize
64KB
-
memory/4404-159-0x0000000000EE0000-0x00000000015D6000-memory.dmpFilesize
7.0MB