Overview

overview

10

Static

static

1

Steam Chec...on.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-03-2023 18:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Steam Checker V0.1 By Abbadon.exe

  • Size

    466KB

  • MD5

    1191fde33722c3e1aba8711b0983eb98

  • SHA1

    8f9a4612b672462aaeb65663cd9b4b8dd16ce345

  • SHA256

    25436b650ac4365eac19bbe56d8bfd79045fb437de6f5476254ac96a6d7afb94

  • SHA512

    d872b5a8845bd13d90b7c09eb4838d64e3b491b1a92d9a2f91fc7aad696e8cb2cd3ddc4bb07930bdd7be719b001fb39f752f8584c40fac6f6671e9255ec461ad

  • SSDEEP

    6144:7t+J2xLKMBCNCc994aCVoYxQOK+GIIIIIIIhIIIIIIIIIIIIIIIU:x+01Bqp99A6b8

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

considered-arrest.at.ply.gg:19159

Attributes
  • install_file

    USB.exe

Signatures

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Steam Checker V0.1 By Abbadon.exe
    "C:\Users\Admin\AppData\Local\Temp\Steam Checker V0.1 By Abbadon.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Users\Admin\AppData\Roaming\Steam Checker V0.1 By Abbadon.exe
      "C:\Users\Admin\AppData\Roaming\Steam Checker V0.1 By Abbadon.exe"
      2⤵
      • Executes dropped EXE
      PID:5060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 824
        3⤵
        • Program crash
        PID:748
    • C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      "C:\Users\Admin\AppData\Roaming\Windows Defender.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4160
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Defender" /tr "C:\Users\Admin\AppData\Roaming\Windows Defender.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3372
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5060 -ip 5060
    1⤵
      PID:1656
    • C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      "C:\Users\Admin\AppData\Roaming\Windows Defender.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1676
    • C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      "C:\Users\Admin\AppData\Roaming\Windows Defender.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2220
    • C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      "C:\Users\Admin\AppData\Roaming\Windows Defender.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3428

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Windows Defender.exe.log
      Filesize

      654B

      MD5

      2ff39f6c7249774be85fd60a8f9a245e

      SHA1

      684ff36b31aedc1e587c8496c02722c6698c1c4e

      SHA256

      e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

      SHA512

      1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Steam Checker V0.1 By Abbadon.exe
      Filesize

      121KB

      MD5

      f0bfac0acff34c1e85a1fa3b63c315a6

      SHA1

      52b9ab7aa6b1836ae278da3575c5c7338f2c43b5

      SHA256

      2ddc9622baef1953e848b441d949bea26e22097149a44b04f0fa870e334c549a

      SHA512

      fd4021d4638ffb54afa237b372f92768a105cd1b1fa7a7012ca64e4bfab73c91f826191b9d07aff09bc26f170b1aea673dd9e08be5fb311708177a7ed4a7fdbc

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Steam Checker V0.1 By Abbadon.exe
      Filesize

      121KB

      MD5

      f0bfac0acff34c1e85a1fa3b63c315a6

      SHA1

      52b9ab7aa6b1836ae278da3575c5c7338f2c43b5

      SHA256

      2ddc9622baef1953e848b441d949bea26e22097149a44b04f0fa870e334c549a

      SHA512

      fd4021d4638ffb54afa237b372f92768a105cd1b1fa7a7012ca64e4bfab73c91f826191b9d07aff09bc26f170b1aea673dd9e08be5fb311708177a7ed4a7fdbc

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Steam Checker V0.1 By Abbadon.exe
      Filesize

      121KB

      MD5

      f0bfac0acff34c1e85a1fa3b63c315a6

      SHA1

      52b9ab7aa6b1836ae278da3575c5c7338f2c43b5

      SHA256

      2ddc9622baef1953e848b441d949bea26e22097149a44b04f0fa870e334c549a

      SHA512

      fd4021d4638ffb54afa237b372f92768a105cd1b1fa7a7012ca64e4bfab73c91f826191b9d07aff09bc26f170b1aea673dd9e08be5fb311708177a7ed4a7fdbc

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      Filesize

      67KB

      MD5

      404dee8c8fe0b8c25ac39f60960dcbf0

      SHA1

      078b5427a3c29a2f410f0e09f667389ad630ed60

      SHA256

      90d2777179534bb5746559397a767aeee141f30a57b53c5d9c2122278b4bc4b7

      SHA512

      9d7c6c2cceff330acea030002c4c7fde0a9ebe4f6a94a035e6fd6f08d7f5fea407680e5acd5baef687a19f40e116c47e8615dd4f728bdac7636529665e83956e

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      Filesize

      67KB

      MD5

      404dee8c8fe0b8c25ac39f60960dcbf0

      SHA1

      078b5427a3c29a2f410f0e09f667389ad630ed60

      SHA256

      90d2777179534bb5746559397a767aeee141f30a57b53c5d9c2122278b4bc4b7

      SHA512

      9d7c6c2cceff330acea030002c4c7fde0a9ebe4f6a94a035e6fd6f08d7f5fea407680e5acd5baef687a19f40e116c47e8615dd4f728bdac7636529665e83956e

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      Filesize

      67KB

      MD5

      404dee8c8fe0b8c25ac39f60960dcbf0

      SHA1

      078b5427a3c29a2f410f0e09f667389ad630ed60

      SHA256

      90d2777179534bb5746559397a767aeee141f30a57b53c5d9c2122278b4bc4b7

      SHA512

      9d7c6c2cceff330acea030002c4c7fde0a9ebe4f6a94a035e6fd6f08d7f5fea407680e5acd5baef687a19f40e116c47e8615dd4f728bdac7636529665e83956e

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      Filesize

      67KB

      MD5

      404dee8c8fe0b8c25ac39f60960dcbf0

      SHA1

      078b5427a3c29a2f410f0e09f667389ad630ed60

      SHA256

      90d2777179534bb5746559397a767aeee141f30a57b53c5d9c2122278b4bc4b7

      SHA512

      9d7c6c2cceff330acea030002c4c7fde0a9ebe4f6a94a035e6fd6f08d7f5fea407680e5acd5baef687a19f40e116c47e8615dd4f728bdac7636529665e83956e

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      Filesize

      67KB

      MD5

      404dee8c8fe0b8c25ac39f60960dcbf0

      SHA1

      078b5427a3c29a2f410f0e09f667389ad630ed60

      SHA256

      90d2777179534bb5746559397a767aeee141f30a57b53c5d9c2122278b4bc4b7

      SHA512

      9d7c6c2cceff330acea030002c4c7fde0a9ebe4f6a94a035e6fd6f08d7f5fea407680e5acd5baef687a19f40e116c47e8615dd4f728bdac7636529665e83956e

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      Filesize

      67KB

      MD5

      404dee8c8fe0b8c25ac39f60960dcbf0

      SHA1

      078b5427a3c29a2f410f0e09f667389ad630ed60

      SHA256

      90d2777179534bb5746559397a767aeee141f30a57b53c5d9c2122278b4bc4b7

      SHA512

      9d7c6c2cceff330acea030002c4c7fde0a9ebe4f6a94a035e6fd6f08d7f5fea407680e5acd5baef687a19f40e116c47e8615dd4f728bdac7636529665e83956e

      Download Submit
    • memory/3224-133-0x0000000000FB0000-0x000000000102A000-memory.dmp
      Filesize

      488KB

      Download
    • memory/4160-160-0x000000001B650000-0x000000001B660000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4160-162-0x000000001B650000-0x000000001B660000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4160-157-0x0000000000940000-0x0000000000958000-memory.dmp
      Filesize

      96KB

      Download
    • memory/5060-158-0x0000000000560000-0x0000000000584000-memory.dmp
      Filesize

      144KB

      Download
    • memory/5060-159-0x00000000053F0000-0x0000000005994000-memory.dmp
      Filesize

      5.6MB

      Download