Analysis

  • max time kernel
    1523s
  • max time network
    1562s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2024 00:54

General

  • Target

    ttd_scam_tool_api.exe

  • Size

    134.0MB

  • MD5

    6ae4dad56fcd74438d8af1757d7f33eb

  • SHA1

    f7ebe503c1946803f4ab1396e633bfffdce75c39

  • SHA256

    7407aaf1912fe74b954790db86481e9f71b69d9ceb5da210366052c64cdf295a

  • SHA512

    3a86f8f1b9e8e5629a1f6097b8ca25905676cabd6083116e5c3a545b728e37ffe53f25571c86ca97f9727cebd5bf9a33250027af703728c3b94beb5de7a508dc

  • SSDEEP

    1536:nfEMGNYm3LveC4lOJqrkbH4HMAa7n6wBmMOQbY:8zGplOYrkbHj3sMOQk

Score
10/10

Malware Config

Extracted

Family

xworm

C2

147.185.221.16:40164

Attributes
  • install_file

    tmp.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ttd_scam_tool_api.exe
    "C:\Users\Admin\AppData\Local\Temp\ttd_scam_tool_api.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ttd_scam_tool_api.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2968
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ttd_scam_tool_api.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E3G8JDFMUNIKLXV6Y8EH.temp

    Filesize

    7KB

    MD5

    5b1903b19946c3db6820fbf0b43e9a73

    SHA1

    41b840d326e26f6ff249967a90fe5808acb62a37

    SHA256

    582b2dbee88f3674c9b547082970ecd881ebeabf88da85f6b55944839fd7d0f3

    SHA512

    e9b142c483109eed32ed168fd82f61addac38d8283c0b7f5849cfaaa52d6577ba32ea8089eb42dbca5b45d6cd6d18c6a60c9677d599bc6e221a403e17f6e5a51

  • memory/1652-1-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

    Filesize

    9.9MB

  • memory/1652-35-0x0000000000B40000-0x0000000000B4E000-memory.dmp

    Filesize

    56KB

  • memory/1652-34-0x00000000005E0000-0x00000000005EC000-memory.dmp

    Filesize

    48KB

  • memory/1652-32-0x000000001C0F0000-0x000000001C1A0000-memory.dmp

    Filesize

    704KB

  • memory/1652-31-0x000000001B1B0000-0x000000001B230000-memory.dmp

    Filesize

    512KB

  • memory/1652-30-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

    Filesize

    9.9MB

  • memory/1652-29-0x000000001B1B0000-0x000000001B230000-memory.dmp

    Filesize

    512KB

  • memory/1652-0-0x0000000000F90000-0x0000000000FA4000-memory.dmp

    Filesize

    80KB

  • memory/2604-26-0x0000000002C60000-0x0000000002CE0000-memory.dmp

    Filesize

    512KB

  • memory/2604-28-0x000007FEEFC90000-0x000007FEF062D000-memory.dmp

    Filesize

    9.6MB

  • memory/2604-20-0x000000001B650000-0x000000001B932000-memory.dmp

    Filesize

    2.9MB

  • memory/2604-25-0x0000000002C60000-0x0000000002CE0000-memory.dmp

    Filesize

    512KB

  • memory/2604-22-0x0000000002340000-0x0000000002348000-memory.dmp

    Filesize

    32KB

  • memory/2604-21-0x000007FEEFC90000-0x000007FEF062D000-memory.dmp

    Filesize

    9.6MB

  • memory/2604-23-0x0000000002C60000-0x0000000002CE0000-memory.dmp

    Filesize

    512KB

  • memory/2604-24-0x000007FEEFC90000-0x000007FEF062D000-memory.dmp

    Filesize

    9.6MB

  • memory/2604-27-0x0000000002C60000-0x0000000002CE0000-memory.dmp

    Filesize

    512KB

  • memory/2968-12-0x0000000002C40000-0x0000000002CC0000-memory.dmp

    Filesize

    512KB

  • memory/2968-14-0x000007FEF2240000-0x000007FEF2BDD000-memory.dmp

    Filesize

    9.6MB

  • memory/2968-13-0x0000000002C40000-0x0000000002CC0000-memory.dmp

    Filesize

    512KB

  • memory/2968-11-0x0000000002C40000-0x0000000002CC0000-memory.dmp

    Filesize

    512KB

  • memory/2968-10-0x000007FEF2240000-0x000007FEF2BDD000-memory.dmp

    Filesize

    9.6MB

  • memory/2968-8-0x000007FEF2240000-0x000007FEF2BDD000-memory.dmp

    Filesize

    9.6MB

  • memory/2968-9-0x0000000002C40000-0x0000000002CC0000-memory.dmp

    Filesize

    512KB

  • memory/2968-7-0x0000000001F00000-0x0000000001F08000-memory.dmp

    Filesize

    32KB

  • memory/2968-6-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

    Filesize

    2.9MB