Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15-03-2023 03:42
Behavioral task
behavioral1
Sample
XWorm V3.1 .exe
Resource
win7-20230220-en
General
-
Target
XWorm V3.1 .exe
-
Size
10.1MB
-
MD5
320526ae9b5dbd99a38d158578c84ccb
-
SHA1
60daf13da5fa663c1e7e67ac113fbb5859264b8c
-
SHA256
91a8aec23ab8e79172c8d7cbf6a733e73157941687eb58e8ffa543b7e721b7ea
-
SHA512
5c62082634d4abc4bc524b268c5bcf476f6a900cba8becc49e143c8b207f0f661e921a26a62df746236f65a9978b7691e541283835056c9c5a6efac0a382cf0f
-
SSDEEP
196608:ih0Avmh7fFbZyD3nvCEg+xyZTEQkM1V8/6zCSR6lGCUOGJ1PldRBo+zoDmAYU:iq1pbqdg+yZTUaCkZXOqdbS
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
AsyncMutex_7SI8OkPnk
-
delay
3
-
install
true
-
install_file
ContainerRuntime.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/Kb8rTgY7
Extracted
xworm
-
install_file
ContainerRuntime.exe
Signatures
-
Async RAT payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/684-75-0x0000000001110000-0x0000000001126000-memory.dmp asyncrat C:\Users\Admin\AppData\Local\Temp\svchost.exe asyncrat \Users\Admin\AppData\Local\Temp\svchost.exe asyncrat C:\Users\Admin\AppData\Local\Temp\svchost.exe asyncrat behavioral1/memory/988-87-0x000000001B560000-0x000000001B5E0000-memory.dmp asyncrat behavioral1/memory/684-88-0x0000000000240000-0x0000000000280000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat \Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat behavioral1/memory/880-106-0x0000000001130000-0x0000000001146000-memory.dmp asyncrat behavioral1/memory/880-107-0x00000000049C0000-0x0000000004A00000-memory.dmp asyncrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
XWorm V3.1 .exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XWorm V3.1 .exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
XWorm V3.1 .exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XWorm V3.1 .exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XWorm V3.1 .exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 832 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
XWorm V3.1.exesvchost.exeContainerRuntime.exepid process 988 XWorm V3.1.exe 684 svchost.exe 880 ContainerRuntime.exe -
Loads dropped DLL 4 IoCs
Processes:
XWorm V3.1 .execmd.exepid process 1712 XWorm V3.1 .exe 1712 XWorm V3.1 .exe 1712 XWorm V3.1 .exe 624 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/1712-56-0x0000000000C30000-0x0000000001B98000-memory.dmp themida behavioral1/memory/1712-58-0x0000000000C30000-0x0000000001B98000-memory.dmp themida behavioral1/memory/1712-86-0x0000000000C30000-0x0000000001B98000-memory.dmp themida -
Processes:
XWorm V3.1 .exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XWorm V3.1 .exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
XWorm V3.1 .exepid process 1712 XWorm V3.1 .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1192 timeout.exe 2004 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exeContainerRuntime.exepid process 684 svchost.exe 880 ContainerRuntime.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
XWorm V3.1.exesvchost.exeContainerRuntime.exedescription pid process Token: SeDebugPrivilege 988 XWorm V3.1.exe Token: SeDebugPrivilege 684 svchost.exe Token: SeDebugPrivilege 880 ContainerRuntime.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ContainerRuntime.exepid process 880 ContainerRuntime.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
XWorm V3.1 .execmd.exesvchost.execmd.execmd.exedescription pid process target process PID 1712 wrote to memory of 988 1712 XWorm V3.1 .exe XWorm V3.1.exe PID 1712 wrote to memory of 988 1712 XWorm V3.1 .exe XWorm V3.1.exe PID 1712 wrote to memory of 988 1712 XWorm V3.1 .exe XWorm V3.1.exe PID 1712 wrote to memory of 988 1712 XWorm V3.1 .exe XWorm V3.1.exe PID 1712 wrote to memory of 684 1712 XWorm V3.1 .exe svchost.exe PID 1712 wrote to memory of 684 1712 XWorm V3.1 .exe svchost.exe PID 1712 wrote to memory of 684 1712 XWorm V3.1 .exe svchost.exe PID 1712 wrote to memory of 684 1712 XWorm V3.1 .exe svchost.exe PID 1712 wrote to memory of 832 1712 XWorm V3.1 .exe cmd.exe PID 1712 wrote to memory of 832 1712 XWorm V3.1 .exe cmd.exe PID 1712 wrote to memory of 832 1712 XWorm V3.1 .exe cmd.exe PID 1712 wrote to memory of 832 1712 XWorm V3.1 .exe cmd.exe PID 832 wrote to memory of 1192 832 cmd.exe timeout.exe PID 832 wrote to memory of 1192 832 cmd.exe timeout.exe PID 832 wrote to memory of 1192 832 cmd.exe timeout.exe PID 832 wrote to memory of 1192 832 cmd.exe timeout.exe PID 684 wrote to memory of 1936 684 svchost.exe cmd.exe PID 684 wrote to memory of 1936 684 svchost.exe cmd.exe PID 684 wrote to memory of 1936 684 svchost.exe cmd.exe PID 684 wrote to memory of 1936 684 svchost.exe cmd.exe PID 684 wrote to memory of 624 684 svchost.exe cmd.exe PID 684 wrote to memory of 624 684 svchost.exe cmd.exe PID 684 wrote to memory of 624 684 svchost.exe cmd.exe PID 684 wrote to memory of 624 684 svchost.exe cmd.exe PID 1936 wrote to memory of 1068 1936 cmd.exe schtasks.exe PID 1936 wrote to memory of 1068 1936 cmd.exe schtasks.exe PID 1936 wrote to memory of 1068 1936 cmd.exe schtasks.exe PID 1936 wrote to memory of 1068 1936 cmd.exe schtasks.exe PID 624 wrote to memory of 2004 624 cmd.exe timeout.exe PID 624 wrote to memory of 2004 624 cmd.exe timeout.exe PID 624 wrote to memory of 2004 624 cmd.exe timeout.exe PID 624 wrote to memory of 2004 624 cmd.exe timeout.exe PID 624 wrote to memory of 880 624 cmd.exe ContainerRuntime.exe PID 624 wrote to memory of 880 624 cmd.exe ContainerRuntime.exe PID 624 wrote to memory of 880 624 cmd.exe ContainerRuntime.exe PID 624 wrote to memory of 880 624 cmd.exe ContainerRuntime.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 .exe"C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 .exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3F04.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.bat""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.batFilesize
163B
MD5ab106923a6589186928679de7d641cc5
SHA1edb335b2f49c209283e05d17457ad9bf4d3c94f2
SHA2566dfdaf01434272d46521e78f21b604d393fef599a28ba4c71df023750b960878
SHA512efff948292d05c742e83088c78cd32a2af49e3328557de82e0b25df2f089ab14c1195f0fbce8d6f298f79dcfad3891b09a3b6ce415fbf36d869b56174a953100
-
C:\Users\Admin\AppData\Local\Temp\tmp2473.tmp.batFilesize
163B
MD5ab106923a6589186928679de7d641cc5
SHA1edb335b2f49c209283e05d17457ad9bf4d3c94f2
SHA2566dfdaf01434272d46521e78f21b604d393fef599a28ba4c71df023750b960878
SHA512efff948292d05c742e83088c78cd32a2af49e3328557de82e0b25df2f089ab14c1195f0fbce8d6f298f79dcfad3891b09a3b6ce415fbf36d869b56174a953100
-
C:\Users\Admin\AppData\Local\Temp\tmp3F04.tmp.batFilesize
160B
MD542595f41242aab1b30e4165c55a78642
SHA1e684e6494c2c943dbbff0b9bec3809fcddf0bd42
SHA2566f723d87b1f6fc27c54262d75b0647eecefa2b0f2835f07795b5b47895aa996a
SHA5121a672b62f36745de6a942a41ec13bd9907cb62795969f6e5d359e17dea9b0a4d2e1483aaa4107f76981889576a3be816f86c990fdc98632e2d2e1745bfa872ef
-
C:\Users\Admin\AppData\Local\Temp\tmp3F04.tmp.batFilesize
160B
MD542595f41242aab1b30e4165c55a78642
SHA1e684e6494c2c943dbbff0b9bec3809fcddf0bd42
SHA2566f723d87b1f6fc27c54262d75b0647eecefa2b0f2835f07795b5b47895aa996a
SHA5121a672b62f36745de6a942a41ec13bd9907cb62795969f6e5d359e17dea9b0a4d2e1483aaa4107f76981889576a3be816f86c990fdc98632e2d2e1745bfa872ef
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
memory/684-75-0x0000000001110000-0x0000000001126000-memory.dmpFilesize
88KB
-
memory/684-88-0x0000000000240000-0x0000000000280000-memory.dmpFilesize
256KB
-
memory/880-111-0x00000000049C0000-0x0000000004A00000-memory.dmpFilesize
256KB
-
memory/880-106-0x0000000001130000-0x0000000001146000-memory.dmpFilesize
88KB
-
memory/880-107-0x00000000049C0000-0x0000000004A00000-memory.dmpFilesize
256KB
-
memory/988-108-0x000000001B560000-0x000000001B5E0000-memory.dmpFilesize
512KB
-
memory/988-89-0x000000001E970000-0x000000001F4DA000-memory.dmpFilesize
11.4MB
-
memory/988-87-0x000000001B560000-0x000000001B5E0000-memory.dmpFilesize
512KB
-
memory/988-85-0x0000000000110000-0x0000000000806000-memory.dmpFilesize
7.0MB
-
memory/988-101-0x000000001B560000-0x000000001B5E0000-memory.dmpFilesize
512KB
-
memory/988-102-0x000000001B560000-0x000000001B5E0000-memory.dmpFilesize
512KB
-
memory/988-110-0x000000001B560000-0x000000001B5E0000-memory.dmpFilesize
512KB
-
memory/988-109-0x000000001B560000-0x000000001B5E0000-memory.dmpFilesize
512KB
-
memory/1712-86-0x0000000000C30000-0x0000000001B98000-memory.dmpFilesize
15.4MB
-
memory/1712-57-0x0000000000C30000-0x0000000001B98000-memory.dmpFilesize
15.4MB
-
memory/1712-58-0x0000000000C30000-0x0000000001B98000-memory.dmpFilesize
15.4MB
-
memory/1712-56-0x0000000000C30000-0x0000000001B98000-memory.dmpFilesize
15.4MB