Analysis
- max time kernel
41s - max time network
40s - platform
windows11-21h2_x64 - resource
win11-20231215-en - resource tags
- submitted
29/01/2024, 14:16
General
- Target betabuild2.exe
- Size 8.0MB
- Sample240129-rlkc3adagm
- SHA256 9897c692bdfe80626c96d8825834be9158979c2926f65b761e41cba607895d8b
Malware Config
Extracted
-
xworm
-
5.39.43.50:5060
-
Install_directory
%AppData%
-
install_file
svh0st.exe
Extracted
-
blackguard
-
https://api.telegram.org/bot6890098459:AAHjv04XcY7xWyP2Vkp5g2wyR9vE4yvtyHs/sendMessage?chat_id=937347419
Signatures
- BlackGuard
Infostealer first seen in Late 2021.
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Drops startup file 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\betabuild2.exe"C:\Users\Admin\AppData\Local\Temp\betabuild2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\buildbeta1.exe"C:\Users\Admin\AppData\Local\Temp\buildbeta1.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\buildbeta1.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'buildbeta1.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svh0st.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svh0st.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svh0st" /tr "C:\Users\Admin\AppData\Roaming\svh0st.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Newtonsoft.Json.dll
Newtonsoft.Json.dll
Newtonsoft.Json.dll
SQLite.Interop.dll
SQLite.Interop.dll
System.Data.SQLite.dll
System.Data.SQLite.dll
System.Data.SQLite.dll
VegaStealer_v2.exe
VegaStealer_v2.exe
VegaStealer_v2.exe
__PSScriptPolicyTest_teag3fwu.ulm.ps1
buildbeta1.exe
v2.exe
Bookmarks.txt
Process.txt
memory/552-242-0x000001114C8D0000-0x000001114C8E0000-memory.dmp
memory/552-240-0x000001114C8D0000-0x000001114C8E0000-memory.dmp
memory/552-244-0x00007FFF19E50000-0x00007FFF1A912000-memory.dmp
memory/552-239-0x000001114C8D0000-0x000001114C8E0000-memory.dmp
memory/552-238-0x00007FFF19E50000-0x00007FFF1A912000-memory.dmp
memory/932-254-0x00007FFF19E50000-0x00007FFF1A912000-memory.dmp
memory/932-258-0x000002035FD80000-0x000002035FD90000-memory.dmp
memory/932-260-0x00007FFF19E50000-0x00007FFF1A912000-memory.dmp
memory/932-256-0x000002035FD80000-0x000002035FD90000-memory.dmp
memory/932-257-0x000002035FD80000-0x000002035FD90000-memory.dmp
memory/932-255-0x000002035FD80000-0x000002035FD90000-memory.dmp
memory/1612-16-0x0000000000E10000-0x0000000000E6E000-memory.dmp
memory/1612-273-0x000000001BCA0000-0x000000001BCB0000-memory.dmp
memory/1612-18-0x00007FFF19E50000-0x00007FFF1A912000-memory.dmp
memory/1612-207-0x000000001BCA0000-0x000000001BCB0000-memory.dmp
memory/1612-241-0x00007FFF19E50000-0x00007FFF1A912000-memory.dmp
memory/1684-109-0x0000000006A00000-0x0000000006A68000-memory.dmp
memory/1684-105-0x0000000006380000-0x00000000063A2000-memory.dmp
memory/1684-52-0x0000000000BA0000-0x0000000000BEA000-memory.dmp
memory/1684-53-0x0000000074710000-0x0000000074EC1000-memory.dmp
memory/1684-224-0x0000000074710000-0x0000000074EC1000-memory.dmp
memory/1684-208-0x0000000007E10000-0x0000000007E2E000-memory.dmp
memory/1684-54-0x0000000005860000-0x0000000005870000-memory.dmp
memory/1684-56-0x0000000006070000-0x0000000006102000-memory.dmp
memory/1684-206-0x0000000008110000-0x0000000008186000-memory.dmp
memory/1684-205-0x0000000007E50000-0x0000000007EB6000-memory.dmp
memory/1684-126-0x0000000008640000-0x0000000008BE6000-memory.dmp
memory/1684-103-0x00000000063B0000-0x0000000006442000-memory.dmp
memory/1684-116-0x0000000006E50000-0x0000000006E8C000-memory.dmp
memory/1684-122-0x0000000007EC0000-0x0000000008082000-memory.dmp
memory/1684-117-0x0000000006DF0000-0x0000000006E11000-memory.dmp
memory/1684-104-0x0000000006010000-0x0000000006060000-memory.dmp
memory/1684-110-0x0000000006A70000-0x0000000006DC7000-memory.dmp
memory/1684-111-0x0000000006990000-0x00000000069DC000-memory.dmp
memory/2304-20-0x0000000000400000-0x0000000000C14000-memory.dmp
memory/4180-220-0x000001C4E2CE0000-0x000001C4E2CF0000-memory.dmp
memory/4180-209-0x00007FFF19E50000-0x00007FFF1A912000-memory.dmp
memory/4180-227-0x00007FFF19E50000-0x00007FFF1A912000-memory.dmp
memory/4180-219-0x000001C4E2CE0000-0x000001C4E2CF0000-memory.dmp
memory/4180-221-0x000001C4E2CE0000-0x000001C4E2CF0000-memory.dmp
memory/4180-210-0x000001C4FB350000-0x000001C4FB372000-memory.dmp
memory/4392-271-0x0000028F62D10000-0x0000028F62D20000-memory.dmp
memory/4392-276-0x00007FFF19E50000-0x00007FFF1A912000-memory.dmp
memory/4392-269-0x00007FFF19E50000-0x00007FFF1A912000-memory.dmp
memory/4392-274-0x0000028F62D10000-0x0000028F62D20000-memory.dmp
memory/4392-272-0x0000028F62D10000-0x0000028F62D20000-memory.dmp