Analysis
-
max time kernel
74s -
max time network
89s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-es -
resource tags
-
submitted
12-12-2023 02:18
General
-
Target
RC7/RC7.exe
-
Size
160KB
-
MD5
40e89aaf41d4ebda079572167d4665e7
-
SHA1
c14a019a862aa3f595da7d15cc993f4f894d10a5
-
SHA256
95388dfe045e7e976186c3ab0286ed8aa77bdb299c867f8c3e46f23ff7624a4d
-
SHA512
035996ef789c0dc972265ec04652d01e1a530e61d4dfdd3fadc6e502a46b054e2b88fd5347d63deba491924b67c466996208f33f9a5019eb60923445551ce554
-
SSDEEP
3072:Vjt4sK0uoEz8jh6oKyIPw+lV59i/XvGO0EFA0K+ymEN4NI:VjysKJ8cNP779Wvwc19yx
Malware Config
Extracted
xworm
owner-cc.gl.at.ply.gg:32281
-
install_file
USB.exe
Extracted
umbral
https://discord.com/api/webhooks/1179573880306806895/9PPafRuKqunRXMBgRp7lwh-lO7PV6gpu6bih39np__mk8ZAghkJ95dBDKUvofe3l-iRe
Signatures
-
Detect Umbral payload 4 IoCs
-
Detect Xworm Payload 2 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Xworm
Xworm is a remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RC7\RC7.exe"C:\Users\Admin\AppData\Local\Temp\RC7\RC7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Umbral1.exe"C:\Users\Admin\AppData\Local\Temp\Umbral1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD56375416e906aab8007f868978d38ee6e
SHA16356ef842d961040345829e3761db95470dbf9fb
SHA25610af414098b953595cbb136eca78ff552d10d37d7592274c55aaba0b47339dd4
SHA512780564f6e63f0c7744675ed64530996da924618177086e499ab91f52312d7d53fbd2be5aef1d20d3e00598b434d201d276f38222ea30a259f8a81394b7e0b6a1
-
Filesize
33KB
MD58931716c4813dd156ecf792123989fba
SHA1dcad2a1eb1ded7a8ccbfe69351eddd9da1f651f5
SHA256a393be455841c82a894cfdd98fdd7c2ed3e0f46570679aecf23a4c1b2a723f29
SHA512b9ec5f9f90db267b2568a83006d1631931c4f9d7375b8dcb4586ab22987f9c9987cadacf0a497a854f2bd747898bf660e25315ce67041c59a39803648ddd4790
-
Filesize
53KB
MD5d6b8e05898dd63005542229dba297080
SHA1e28e07eb22f57328e90e730634f3e847b5e7097e
SHA256048b13385454f9294947870c7fa0d2644e42972f111435d6542742ebf4a41840
SHA5124db08cb6675fe81ad61d6634f736fb5674856a0fa8635a6e452b1364e243248e9c37ea5ee818f25fa9e97324cd6b1b6da8c7e56e70fbd0fdf719e1b8ed426e8c
-
Filesize
60KB
MD5fd41a98611978677f1adc60f86383ea0
SHA1200cfd48d7f7d28cff9c177cdd804e6fd578c015
SHA256ffc549f9e84b6ecaa96e1cb49c18a8bdd89d536e0556962c88995967009cdc3d
SHA51287a0d544d9b1dd2b53d40cd54d2c6955927dc287d2cf557eb50f408c3e6002efdac3ecbe908b49bf153bb9276d23e3e459bbaa502167cc52a63ae08a40251270
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
184KB