Analysis

  • max time kernel
    6s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2024 03:18

General

  • Target

    a231145abbb216fb9ad0bb81c51832f5.exe

  • Size

    92KB

  • MD5

    a231145abbb216fb9ad0bb81c51832f5

  • SHA1

    c93e051e8c374bbcb153b1862e6e101abb73775c

  • SHA256

    305817d3405f3f1d344836b74d5e04af40da8e11d5334c6401c94a3baceb34ea

  • SHA512

    3c67f60a04495fc14b3bdacf6d19a509c13dddcf29227696d69336878f3059bc33eb6a2183d12fd6a88c8fe0533c0787eb9599686564c061e3d500b1d34c3fcd

  • SSDEEP

    1536:jynazMODiSbl57b/4tXzQP8AltrOSWht1s5qXxx3M9H+NjExnCMT3JuT+d/1SWPO:jOa9Dnv7ba85OTt25x+Z6Lh1ZP/Bjvfs

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/TgduC2Px

Signatures

  • Detect Xworm Payload 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a231145abbb216fb9ad0bb81c51832f5.exe
    "C:\Users\Admin\AppData\Local\Temp\a231145abbb216fb9ad0bb81c51832f5.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Windows\system32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "System Update" /tr "C:\ProgramData\Microsoft\Windows\Templates\xxnnzdq3.qbb.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1856
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "System Update" /tr "C:\ProgramData\Microsoft\Windows\Templates\xxnnzdq3.qbb.exe"
        3⤵
        • Creates scheduled task(s)
        PID:2680
    • C:\ProgramData\Microsoft\Windows\Templates\xxnnzdq3.qbb.exe
      "C:\ProgramData\Microsoft\Windows\Templates\xxnnzdq3.qbb.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Templates\xxnnzdq3.qbb.exe'
        3⤵
          PID:2488
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'xxnnzdq3.qbb.exe'
          3⤵
            PID:2700
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
            3⤵
              PID:1188
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
              3⤵
                PID:2704
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
                3⤵
                • Creates scheduled task(s)
                PID:2336
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {C0E66CED-1C89-4CC8-A08C-1E91B61F8665} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]
            1⤵
              PID:1376
              • C:\Users\Admin\AppData\Roaming\svchost.exe
                C:\Users\Admin\AppData\Roaming\svchost.exe
                2⤵
                  PID:2240
                • C:\Users\Admin\AppData\Roaming\svchost.exe
                  C:\Users\Admin\AppData\Roaming\svchost.exe
                  2⤵
                    PID:2528

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\Microsoft\Windows\Templates\xxnnzdq3.qbb.exe

                  Filesize

                  541KB

                  MD5

                  d31db17a6fd4962a7bf7253eaa6e416f

                  SHA1

                  930c6fe6d67104491be90d84eaa78344f6e78b90

                  SHA256

                  34c404c847bbeb85192d3b7e9fd556cedc06ea5b42a4d6fcc4c846e6f623265c

                  SHA512

                  42b23a54c1cfacf6be5f73fd5f46da7ccfff15a0c11322758595385aae773e8a0b1e58ab73f9e325d1f5b70f6bd89237894ae7b238e1bde16ef24305085a1262

                • C:\ProgramData\Microsoft\Windows\Templates\xxnnzdq3.qbb.exe

                  Filesize

                  279KB

                  MD5

                  a7e25e7c6f1f7b46aabbf29691db97c4

                  SHA1

                  73f7c81e71e88b64c7f5e13b6ce714ef4f0677b6

                  SHA256

                  fb0aacdda8c2cf495c138919c558c3e5606685fd09ea1e780a1007da8caf57b3

                  SHA512

                  73bdcca80656ea2dcfad5df6db3309713cb2f181b0ab8ba9786cf22aca3d96ec8dffc1d39edbebd73ae55ba3b01c7866316f3d7d6f4ecb1d16f659c3fe3b5e7e

                • C:\ProgramData\Microsoft\Windows\Templates\xxnnzdq3.qbb.exe

                  Filesize

                  407KB

                  MD5

                  9eebc73cf24aad165b5d5c7e08e8eb19

                  SHA1

                  e1936d1a8e9c2825b8c59cd459baabe2d8fe69d8

                  SHA256

                  1ac931778ab5027e60e207f29852378498b7af6387d368999e88d746e7a33382

                  SHA512

                  fa4e52be7890a373ef9f4f308cfa110f33878a95a0a6913f01fee1210969722e07fead733c60f3baa2df3b92704cf15fc59889854b9ef53cbc4cf3a77e4450cd

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                  Filesize

                  65KB

                  MD5

                  ac05d27423a85adc1622c714f2cb6184

                  SHA1

                  b0fe2b1abddb97837ea0195be70ab2ff14d43198

                  SHA256

                  c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                  SHA512

                  6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                • C:\Users\Admin\AppData\Local\Temp\Tar371C.tmp

                  Filesize

                  137KB

                  MD5

                  36faa4bc54a632caa1f257a70dd49630

                  SHA1

                  d2f206b11d348265e86981f0afd810b859935a6f

                  SHA256

                  c11042e1beb524107d62c922558c015394765d87e8492e129ffc5277a1d03b7e

                  SHA512

                  8a94921cabd0da11da779cf178ad8a2dd5e6e562057a920daad305a6ff7223ef56fbe8cd71f009b9f4f8266739ad06950c289f2f924d59cc78ff5a809d5a3f62

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3039UPTQJ4G6NE6WNJWE.temp

                  Filesize

                  1KB

                  MD5

                  e5d1b6b6872fa3b087179e93c05d98b9

                  SHA1

                  93f59f7f86582016ec0114769b01ece5dc2b0e16

                  SHA256

                  f2b64ce58a9dd6d624463e0c7545feb3facdbce217eaf38f92ed5c5a5db6e511

                  SHA512

                  8ca393c05dd956aef02c276c95fe6bf93add2001cc13ab78d1583e79946c3d76cfe8c95ac08558f18bc6122a94f7c513eedd440bafb3afeed3611d9039d2c218

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                  Filesize

                  7KB

                  MD5

                  c6c5b8649bd6cd640318c567b70b2045

                  SHA1

                  26544bb3eafd426100a5233f7d5520fea32b43e5

                  SHA256

                  2045da77ff4e8f9d7c8d3c50f80afb72353bef36b26c12b9bbe0a823d2f90978

                  SHA512

                  8a768ad5e0b7c4c56b07adde99f49bf552fefea621292841dd4c66b41b060275b04c7fa7b1c77fbed195b32831924decc41b93c02ff01f3754c84adbaa4c7aed

                • C:\Users\Admin\AppData\Roaming\svchost.exe

                  Filesize

                  763KB

                  MD5

                  cbf6d46f2ed7c01204266172b022fd97

                  SHA1

                  d8195435ab66bb64ee4ccbf68403ae09b4bb3314

                  SHA256

                  fd00538f78e72004a59bca40fd5fb1e4e4c370de1a85c2fed394af14d6f16720

                  SHA512

                  7981482b232814f65dc57d75acbe74399bd64c9942fb98853c8e8bb11b8f5ea3da65e6b2250e16381b07e835254eb3ec4322e7438640572a7319575fc5da3d5c

                • C:\Users\Admin\AppData\Roaming\svchost.exe

                  Filesize

                  535KB

                  MD5

                  2e6fb5bf500e4049dc0ac9f8d7377582

                  SHA1

                  b91a98c85d4b0cb8fbd35f26d9f0a033bc64ddfc

                  SHA256

                  aa78e1200ec37b189c7cb211caa82fb535dc974f33637699136321be1ef39e86

                  SHA512

                  f90d7084473102a85624c520532dea40282cb3b908b855b516349e737c5ffd1b752436aa5e0f64b01661804319e5ab95a1a245e138d415f66537a39e7f256033

                • C:\Users\Admin\AppData\Roaming\svchost.exe

                  Filesize

                  104KB

                  MD5

                  8a959e5cf948ab7fdf5e4ff5895eb2c4

                  SHA1

                  c79dacda4b0adfc6eeab39e857bdfa73c21da11d

                  SHA256

                  8b1cd14028042b36993f97fb23e4e15738360c8133b0ab19fd0c85362c73fd55

                  SHA512

                  a8844f2fa8c132c4f1ee7d9f6cb59e3626e87d95eced3299a0f53715633c8c599ae74d748761d2f9dd97e9efd2895069eb5b769f56fc2bc6c8b0085c4ab785ce

                • memory/780-24-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/780-1-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/780-0-0x0000000000170000-0x000000000018E000-memory.dmp

                  Filesize

                  120KB

                • memory/1188-65-0x00000000029E0000-0x0000000002A60000-memory.dmp

                  Filesize

                  512KB

                • memory/1188-66-0x000007FEEDD50000-0x000007FEEE6ED000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1188-62-0x00000000029E0000-0x0000000002A60000-memory.dmp

                  Filesize

                  512KB

                • memory/1188-60-0x00000000029E0000-0x0000000002A60000-memory.dmp

                  Filesize

                  512KB

                • memory/1188-59-0x000007FEEDD50000-0x000007FEEE6ED000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1188-63-0x00000000029E4000-0x00000000029E7000-memory.dmp

                  Filesize

                  12KB

                • memory/1188-61-0x000007FEEDD50000-0x000007FEEE6ED000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2240-124-0x0000000000EE0000-0x0000000000EFA000-memory.dmp

                  Filesize

                  104KB

                • memory/2240-126-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/2240-125-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/2488-36-0x0000000002D50000-0x0000000002DD0000-memory.dmp

                  Filesize

                  512KB

                • memory/2488-32-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

                  Filesize

                  32KB

                • memory/2488-37-0x0000000002D50000-0x0000000002DD0000-memory.dmp

                  Filesize

                  512KB

                • memory/2488-38-0x0000000002D50000-0x0000000002DD0000-memory.dmp

                  Filesize

                  512KB

                • memory/2488-39-0x000007FEEDD50000-0x000007FEEE6ED000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2488-33-0x000007FEEDD50000-0x000007FEEE6ED000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2488-35-0x000007FEEDD50000-0x000007FEEE6ED000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2488-34-0x0000000002D50000-0x0000000002DD0000-memory.dmp

                  Filesize

                  512KB

                • memory/2488-31-0x000000001B730000-0x000000001BA12000-memory.dmp

                  Filesize

                  2.9MB

                • memory/2528-128-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/2528-129-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/2676-64-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/2676-76-0x000000001AB90000-0x000000001AC10000-memory.dmp

                  Filesize

                  512KB

                • memory/2676-23-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/2676-25-0x00000000001C0000-0x00000000001DA000-memory.dmp

                  Filesize

                  104KB

                • memory/2676-26-0x000000001AB90000-0x000000001AC10000-memory.dmp

                  Filesize

                  512KB

                • memory/2700-48-0x0000000002BD0000-0x0000000002C50000-memory.dmp

                  Filesize

                  512KB

                • memory/2700-52-0x0000000002BD0000-0x0000000002C50000-memory.dmp

                  Filesize

                  512KB

                • memory/2700-47-0x0000000001D90000-0x0000000001D98000-memory.dmp

                  Filesize

                  32KB

                • memory/2700-46-0x000007FEED3B0000-0x000007FEEDD4D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2700-45-0x000000001B590000-0x000000001B872000-memory.dmp

                  Filesize

                  2.9MB

                • memory/2700-53-0x000007FEED3B0000-0x000007FEEDD4D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2700-49-0x000007FEED3B0000-0x000007FEEDD4D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2700-50-0x0000000002BD0000-0x0000000002C50000-memory.dmp

                  Filesize

                  512KB

                • memory/2700-51-0x0000000002BD0000-0x0000000002C50000-memory.dmp

                  Filesize

                  512KB

                • memory/2704-79-0x000007FEED3B0000-0x000007FEEDD4D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2704-77-0x00000000028C0000-0x0000000002940000-memory.dmp

                  Filesize

                  512KB

                • memory/2704-73-0x00000000028C0000-0x0000000002940000-memory.dmp

                  Filesize

                  512KB

                • memory/2704-78-0x00000000028C0000-0x0000000002940000-memory.dmp

                  Filesize

                  512KB

                • memory/2704-72-0x000007FEED3B0000-0x000007FEEDD4D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2704-75-0x00000000028C0000-0x0000000002940000-memory.dmp

                  Filesize

                  512KB

                • memory/2704-74-0x000007FEED3B0000-0x000007FEEDD4D000-memory.dmp

                  Filesize

                  9.6MB