Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2023 03:42
Behavioral task
behavioral1
Sample
XWorm V3.1 .exe
Resource
win7-20230220-en
General
-
Target
XWorm V3.1 .exe
-
Size
10.1MB
-
MD5
320526ae9b5dbd99a38d158578c84ccb
-
SHA1
60daf13da5fa663c1e7e67ac113fbb5859264b8c
-
SHA256
91a8aec23ab8e79172c8d7cbf6a733e73157941687eb58e8ffa543b7e721b7ea
-
SHA512
5c62082634d4abc4bc524b268c5bcf476f6a900cba8becc49e143c8b207f0f661e921a26a62df746236f65a9978b7691e541283835056c9c5a6efac0a382cf0f
-
SSDEEP
196608:ih0Avmh7fFbZyD3nvCEg+xyZTEQkM1V8/6zCSR6lGCUOGJ1PldRBo+zoDmAYU:iq1pbqdg+yZTUaCkZXOqdbS
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
AsyncMutex_7SI8OkPnk
-
delay
3
-
install
true
-
install_file
ContainerRuntime.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/Kb8rTgY7
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\svchost.exe asyncrat C:\Users\Admin\AppData\Local\Temp\svchost.exe asyncrat C:\Users\Admin\AppData\Local\Temp\svchost.exe asyncrat behavioral2/memory/1248-158-0x0000000000DC0000-0x0000000000DD6000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe asyncrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
XWorm V3.1 .exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XWorm V3.1 .exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
XWorm V3.1 .exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XWorm V3.1 .exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XWorm V3.1 .exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XWorm V3.1 .exesvchost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation XWorm V3.1 .exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 3 IoCs
Processes:
XWorm V3.1.exesvchost.exeContainerRuntime.exepid process 4220 XWorm V3.1.exe 1248 svchost.exe 4768 ContainerRuntime.exe -
Processes:
resource yara_rule behavioral2/memory/1788-136-0x0000000000D00000-0x0000000001C68000-memory.dmp themida behavioral2/memory/1788-137-0x0000000000D00000-0x0000000001C68000-memory.dmp themida behavioral2/memory/1788-166-0x0000000000D00000-0x0000000001C68000-memory.dmp themida -
Processes:
XWorm V3.1 .exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XWorm V3.1 .exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
XWorm V3.1 .exepid process 1788 XWorm V3.1 .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 3532 timeout.exe 4596 timeout.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
svchost.exeContainerRuntime.exepid process 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 1248 svchost.exe 4768 ContainerRuntime.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
XWorm V3.1.exesvchost.exeContainerRuntime.exedescription pid process Token: SeDebugPrivilege 4220 XWorm V3.1.exe Token: SeDebugPrivilege 1248 svchost.exe Token: SeDebugPrivilege 4768 ContainerRuntime.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ContainerRuntime.exepid process 4768 ContainerRuntime.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
XWorm V3.1 .execmd.exesvchost.execmd.execmd.exedescription pid process target process PID 1788 wrote to memory of 4220 1788 XWorm V3.1 .exe XWorm V3.1.exe PID 1788 wrote to memory of 4220 1788 XWorm V3.1 .exe XWorm V3.1.exe PID 1788 wrote to memory of 1248 1788 XWorm V3.1 .exe svchost.exe PID 1788 wrote to memory of 1248 1788 XWorm V3.1 .exe svchost.exe PID 1788 wrote to memory of 1248 1788 XWorm V3.1 .exe svchost.exe PID 1788 wrote to memory of 4884 1788 XWorm V3.1 .exe cmd.exe PID 1788 wrote to memory of 4884 1788 XWorm V3.1 .exe cmd.exe PID 1788 wrote to memory of 4884 1788 XWorm V3.1 .exe cmd.exe PID 4884 wrote to memory of 3532 4884 cmd.exe timeout.exe PID 4884 wrote to memory of 3532 4884 cmd.exe timeout.exe PID 4884 wrote to memory of 3532 4884 cmd.exe timeout.exe PID 1248 wrote to memory of 3928 1248 svchost.exe cmd.exe PID 1248 wrote to memory of 3928 1248 svchost.exe cmd.exe PID 1248 wrote to memory of 3928 1248 svchost.exe cmd.exe PID 1248 wrote to memory of 4612 1248 svchost.exe cmd.exe PID 1248 wrote to memory of 4612 1248 svchost.exe cmd.exe PID 1248 wrote to memory of 4612 1248 svchost.exe cmd.exe PID 4612 wrote to memory of 4596 4612 cmd.exe timeout.exe PID 4612 wrote to memory of 4596 4612 cmd.exe timeout.exe PID 4612 wrote to memory of 4596 4612 cmd.exe timeout.exe PID 3928 wrote to memory of 4496 3928 cmd.exe schtasks.exe PID 3928 wrote to memory of 4496 3928 cmd.exe schtasks.exe PID 3928 wrote to memory of 4496 3928 cmd.exe schtasks.exe PID 4612 wrote to memory of 4768 4612 cmd.exe ContainerRuntime.exe PID 4612 wrote to memory of 4768 4612 cmd.exe ContainerRuntime.exe PID 4612 wrote to memory of 4768 4612 cmd.exe ContainerRuntime.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 .exe"C:\Users\Admin\AppData\Local\Temp\XWorm V3.1 .exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ContainerRuntime" /tr '"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE573.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"C:\Users\Admin\AppData\Roaming\ContainerRuntime.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCD67.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exeFilesize
6.9MB
MD537a9fdc56e605d2342da88a6e6182b4b
SHA120bc3df33bbbb676d2a3c572cff4c1d58c79055d
SHA256422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
SHA512f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Local\Temp\tmpCD67.tmp.batFilesize
163B
MD5bb948171c165cab2d89af1d788668ea7
SHA1ea10b5a47f31629cf100474ac0e792577922ae2e
SHA256b9acebe9633f6dd21f1a6cd15ea7cd39b600ace59d1c86aff3b386463d24ca03
SHA5123d4316a34c9aa85e5c1c3cbff6b05f5f4409da631f3054c1e7b800871213841aa9210fcf9610a86c1dd245b7ebcc7cb9046461f9a4004a2b40956d33cfd07f50
-
C:\Users\Admin\AppData\Local\Temp\tmpE573.tmp.batFilesize
160B
MD5e707b296126fc7241bdbf79a7fef6735
SHA1fafa0009de3270b0c996ab488cf751cef15b8e3e
SHA25676be6dd3f89942b1c527413e23b7d9b4afb0cacc79951c24c4c815c7eb4bdecf
SHA51299c226046c27e3a92a730c58780348b27df6f8703b354d9a255c7c20953b4b9586e7283ee325d48b1254c2e6bc64d8b08cc711e4d58ec5674fabf2e4bf09913e
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
C:\Users\Admin\AppData\Roaming\ContainerRuntime.exeFilesize
61KB
MD5e59c2ff54922cbc9a69e7ae878539eb8
SHA109f50da27d4bd6a9a4f7c46743734496b3e8359a
SHA256d6ba147ab0933d4ecb539071a4b6c32e3d24856c5badd508db33de2692644e88
SHA51210cf7859f2e2c75a24495b2d05deb4e5f770ebd80b4831b3b603df83d3a004e102429658e01acb7609b6c774441328bf9420292e66352a4759a70a700750c9a4
-
memory/1248-158-0x0000000000DC0000-0x0000000000DD6000-memory.dmpFilesize
88KB
-
memory/1788-136-0x0000000000D00000-0x0000000001C68000-memory.dmpFilesize
15.4MB
-
memory/1788-138-0x0000000005D50000-0x0000000005DEC000-memory.dmpFilesize
624KB
-
memory/1788-166-0x0000000000D00000-0x0000000001C68000-memory.dmpFilesize
15.4MB
-
memory/1788-137-0x0000000000D00000-0x0000000001C68000-memory.dmpFilesize
15.4MB
-
memory/1788-159-0x0000000006520000-0x0000000006AC4000-memory.dmpFilesize
5.6MB
-
memory/1788-133-0x0000000000D00000-0x0000000001C68000-memory.dmpFilesize
15.4MB
-
memory/4220-168-0x000000001CC60000-0x000000001CC70000-memory.dmpFilesize
64KB
-
memory/4220-171-0x000000001CC60000-0x000000001CC70000-memory.dmpFilesize
64KB
-
memory/4220-160-0x0000000000110000-0x0000000000806000-memory.dmpFilesize
7.0MB
-
memory/4220-180-0x000000001CC60000-0x000000001CC70000-memory.dmpFilesize
64KB
-
memory/4220-182-0x000000001CC60000-0x000000001CC70000-memory.dmpFilesize
64KB
-
memory/4768-181-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/4768-183-0x0000000005DB0000-0x0000000005E42000-memory.dmpFilesize
584KB
-
memory/4768-184-0x00000000061B0000-0x00000000061BA000-memory.dmpFilesize
40KB
-
memory/4768-185-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB