Analysis
- max time kernel
142s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231201-en - resource tags
- submitted
04/12/2023, 16:56
General
- Target HWID.exe
- Size 149KB
- Sample231204-vfx9hsdb84
- SHA256 0f8980228acd3d9dd7bc9208c13a68b244ee903212327e4d350a82010aa37993
Malware Config
Extracted
-
xworm
-
owner-cc.gl.at.ply.gg:32281
-
Install_directory
%AppData%
-
install_file
WindowsSoundSystem.exe
Extracted
-
umbral
-
https://discord.com/api/webhooks/1181010758201520208/iCxvWqp_69ofS-eHs5naW1_4vBzPxLSr9zIR5Bso1e4orm8yDICPrre5CTF60DCywY_3
Signatures
- Detect Umbral payload 4 IoCs
- Detect Xworm Payload 4 IoCs
- Umbral
Umbral stealer is an opensource moduler stealer written in C#.
- Xworm
Xworm is a remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HWID.exe"C:\Users\Admin\AppData\Local\Temp\HWID.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Windows sound.exe"C:\Users\Admin\AppData\Local\Temp\Windows sound.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Windows Blue Tooth.exe"C:\Users\Admin\AppData\Local\Temp\Windows Blue Tooth.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Windows Blue Tooth.exe
Windows Blue Tooth.exe
Windows Blue Tooth.exe
Windows sound.exe
Windows sound.exe
Windows sound.exe
memory/3220-0-0x0000000000F30000-0x0000000000F5C000-memory.dmp
memory/3220-1-0x00007FF926410000-0x00007FF926ED1000-memory.dmp
memory/3220-2-0x000000001C040000-0x000000001C050000-memory.dmp
memory/3220-29-0x00007FF926410000-0x00007FF926ED1000-memory.dmp
memory/4188-28-0x00007FF926410000-0x00007FF926ED1000-memory.dmp
memory/4188-27-0x0000000000460000-0x000000000047A000-memory.dmp
memory/4188-32-0x000000001B150000-0x000000001B160000-memory.dmp
memory/4188-37-0x00007FF926410000-0x00007FF926ED1000-memory.dmp
memory/4188-40-0x000000001B150000-0x000000001B160000-memory.dmp
memory/4852-30-0x00007FF926410000-0x00007FF926ED1000-memory.dmp
memory/4852-25-0x0000024E7A390000-0x0000024E7A3D0000-memory.dmp
memory/4852-31-0x0000024E7BF30000-0x0000024E7BF40000-memory.dmp
memory/4852-38-0x00007FF926410000-0x00007FF926ED1000-memory.dmp
memory/4852-39-0x0000024E7BF30000-0x0000024E7BF40000-memory.dmp