Analysis
-
max time kernel
62s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
28/08/2023, 14:33
General
-
Target
xw/build.exe
-
Size
536KB
-
MD5
8fcce8b5f248b8dcc87748f6bd5c5826
-
SHA1
5b1cfd6d6a771bcc8343cac60f6f14c6b22e1336
-
SHA256
772eb622cb13a716b023acb5343b863ddd24d9c45be8189ea011ba4fdba911bd
-
SHA512
24078f4705ad0c58e3244d844e90e7f1a8e54d8bfcf57b2de2ad9ecba622b2625af108a2bbcaf020f3cbf96768194110a6adf0f1a86064766232245db6ae6ad5
-
SSDEEP
12288:z1a7kKdZ+f3ONUVLvb8n/Gr4BqkUAZL8IFL5/qYE/bOd:z1anH+rvMUUqkUAV8Qx
Malware Config
Extracted
xworm
comes-reasoning.at.ply.gg:12803
-
install_file
USB.exe
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Sets file execution options in registry 2 TTPs 4 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xw\build.exe"C:\Users\Admin\AppData\Local\Temp\xw\build.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ëè÷íûé.exe"C:\Users\Admin\AppData\Local\Temp\Ëè÷íûé.exe"2⤵
- UAC bypass
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\xw.exe"C:\Users\Admin\AppData\Local\Temp\xw.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "xw" /tr "C:\Users\Admin\AppData\Roaming\xw.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Ëè÷íûé.exeC:\Users\Admin\AppData\Local\Temp\Ëè÷íûé.exe explorer.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\xw.exeC:\Users\Admin\AppData\Roaming\xw.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD53c1fc424fb978ecaf58468268650090e
SHA17bdc6a3e5e82b905ed7a0e60447730b408781105
SHA2564e7bfc66e62442c96e2d8414d5d9f3b2c729214fcc5550f8c21d95dc6d7cac7c
SHA512e85645f458284c1d881e62a29a278967d29330abf241e41c726f13e8e99e48f8feca453370ab3eb702b4d0e95d32e39ab1e1d3881a02b51d9ed310cf8f643948
-
Filesize
48KB
MD53c1fc424fb978ecaf58468268650090e
SHA17bdc6a3e5e82b905ed7a0e60447730b408781105
SHA2564e7bfc66e62442c96e2d8414d5d9f3b2c729214fcc5550f8c21d95dc6d7cac7c
SHA512e85645f458284c1d881e62a29a278967d29330abf241e41c726f13e8e99e48f8feca453370ab3eb702b4d0e95d32e39ab1e1d3881a02b51d9ed310cf8f643948
-
Filesize
48KB
MD53c1fc424fb978ecaf58468268650090e
SHA17bdc6a3e5e82b905ed7a0e60447730b408781105
SHA2564e7bfc66e62442c96e2d8414d5d9f3b2c729214fcc5550f8c21d95dc6d7cac7c
SHA512e85645f458284c1d881e62a29a278967d29330abf241e41c726f13e8e99e48f8feca453370ab3eb702b4d0e95d32e39ab1e1d3881a02b51d9ed310cf8f643948
-
Filesize
478KB
MD588cab6f259b4203ca43c6baaf46a7794
SHA1c2a4670dfe5206401cd8930e7005e78417e6341f
SHA256c1aed327b29964194bb1ba9d109ccb78c8ae6436b9db58e1495baba7940aea43
SHA51275260da020670772916d676efacc6bce34536511c85a6dde7ed48094905f0b0403e3a87d2793f4fefea367ff908b01dabe2c81fd95ba71f631dca59137dfcb8f
-
Filesize
478KB
MD588cab6f259b4203ca43c6baaf46a7794
SHA1c2a4670dfe5206401cd8930e7005e78417e6341f
SHA256c1aed327b29964194bb1ba9d109ccb78c8ae6436b9db58e1495baba7940aea43
SHA51275260da020670772916d676efacc6bce34536511c85a6dde7ed48094905f0b0403e3a87d2793f4fefea367ff908b01dabe2c81fd95ba71f631dca59137dfcb8f
-
Filesize
478KB
MD588cab6f259b4203ca43c6baaf46a7794
SHA1c2a4670dfe5206401cd8930e7005e78417e6341f
SHA256c1aed327b29964194bb1ba9d109ccb78c8ae6436b9db58e1495baba7940aea43
SHA51275260da020670772916d676efacc6bce34536511c85a6dde7ed48094905f0b0403e3a87d2793f4fefea367ff908b01dabe2c81fd95ba71f631dca59137dfcb8f
-
Filesize
478KB
MD588cab6f259b4203ca43c6baaf46a7794
SHA1c2a4670dfe5206401cd8930e7005e78417e6341f
SHA256c1aed327b29964194bb1ba9d109ccb78c8ae6436b9db58e1495baba7940aea43
SHA51275260da020670772916d676efacc6bce34536511c85a6dde7ed48094905f0b0403e3a87d2793f4fefea367ff908b01dabe2c81fd95ba71f631dca59137dfcb8f
-
Filesize
48KB
MD53c1fc424fb978ecaf58468268650090e
SHA17bdc6a3e5e82b905ed7a0e60447730b408781105
SHA2564e7bfc66e62442c96e2d8414d5d9f3b2c729214fcc5550f8c21d95dc6d7cac7c
SHA512e85645f458284c1d881e62a29a278967d29330abf241e41c726f13e8e99e48f8feca453370ab3eb702b4d0e95d32e39ab1e1d3881a02b51d9ed310cf8f643948
-
Filesize
48KB
MD53c1fc424fb978ecaf58468268650090e
SHA17bdc6a3e5e82b905ed7a0e60447730b408781105
SHA2564e7bfc66e62442c96e2d8414d5d9f3b2c729214fcc5550f8c21d95dc6d7cac7c
SHA512e85645f458284c1d881e62a29a278967d29330abf241e41c726f13e8e99e48f8feca453370ab3eb702b4d0e95d32e39ab1e1d3881a02b51d9ed310cf8f643948
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
564KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB