Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
08/02/2024, 03:05
Static task
static1
Behavioral task
behavioral1
Sample
windows.exe
Resource
win10-20231215-en
Behavioral task
behavioral2
Sample
windows.exe
Resource
win7-20231215-en
Behavioral task
behavioral3
Sample
windows.exe
Resource
win10-20231215-en
Behavioral task
behavioral4
Sample
windows.exe
Resource
win10v2004-20231222-en
General
-
Target
windows.exe
-
Size
332KB
-
MD5
21b941b814ff8935b0f5b308a8c7ec9c
-
SHA1
568e4c957b15f002eebb0bb291537e4c36c8f390
-
SHA256
986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb
-
SHA512
dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18
-
SSDEEP
6144:rd4bYBotL3mIhs8DyFPd4U1mGvEMdn7Ml/wCmCJ:rd4EBCqL4RpMi9XmCJ
Malware Config
Extracted
xworm
hai1723rat-60039.portmap.io:60039
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral3/memory/3816-113-0x0000000000F90000-0x0000000000FA8000-memory.dmp family_xworm -
Executes dropped EXE 1 IoCs
pid Process 3816 pcnetwork.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\pcnetwork.exe windows.exe File opened for modification C:\Windows\pcnetwork.exe windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1752 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1460 powershell.exe 1460 powershell.exe 1460 powershell.exe 1236 powershell.exe 1236 powershell.exe 1236 powershell.exe 1628 powershell.exe 1628 powershell.exe 1628 powershell.exe 1108 powershell.exe 1108 powershell.exe 1108 powershell.exe 3816 pcnetwork.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3516 windows.exe Token: SeDebugPrivilege 1460 powershell.exe Token: SeIncreaseQuotaPrivilege 1460 powershell.exe Token: SeSecurityPrivilege 1460 powershell.exe Token: SeTakeOwnershipPrivilege 1460 powershell.exe Token: SeLoadDriverPrivilege 1460 powershell.exe Token: SeSystemProfilePrivilege 1460 powershell.exe Token: SeSystemtimePrivilege 1460 powershell.exe Token: SeProfSingleProcessPrivilege 1460 powershell.exe Token: SeIncBasePriorityPrivilege 1460 powershell.exe Token: SeCreatePagefilePrivilege 1460 powershell.exe Token: SeBackupPrivilege 1460 powershell.exe Token: SeRestorePrivilege 1460 powershell.exe Token: SeShutdownPrivilege 1460 powershell.exe Token: SeDebugPrivilege 1460 powershell.exe Token: SeSystemEnvironmentPrivilege 1460 powershell.exe Token: SeRemoteShutdownPrivilege 1460 powershell.exe Token: SeUndockPrivilege 1460 powershell.exe Token: SeManageVolumePrivilege 1460 powershell.exe Token: 33 1460 powershell.exe Token: 34 1460 powershell.exe Token: 35 1460 powershell.exe Token: 36 1460 powershell.exe Token: SeDebugPrivilege 1236 powershell.exe Token: SeIncreaseQuotaPrivilege 1236 powershell.exe Token: SeSecurityPrivilege 1236 powershell.exe Token: SeTakeOwnershipPrivilege 1236 powershell.exe Token: SeLoadDriverPrivilege 1236 powershell.exe Token: SeSystemProfilePrivilege 1236 powershell.exe Token: SeSystemtimePrivilege 1236 powershell.exe Token: SeProfSingleProcessPrivilege 1236 powershell.exe Token: SeIncBasePriorityPrivilege 1236 powershell.exe Token: SeCreatePagefilePrivilege 1236 powershell.exe Token: SeBackupPrivilege 1236 powershell.exe Token: SeRestorePrivilege 1236 powershell.exe Token: SeShutdownPrivilege 1236 powershell.exe Token: SeDebugPrivilege 1236 powershell.exe Token: SeSystemEnvironmentPrivilege 1236 powershell.exe Token: SeRemoteShutdownPrivilege 1236 powershell.exe Token: SeUndockPrivilege 1236 powershell.exe Token: SeManageVolumePrivilege 1236 powershell.exe Token: 33 1236 powershell.exe Token: 34 1236 powershell.exe Token: 35 1236 powershell.exe Token: 36 1236 powershell.exe Token: SeDebugPrivilege 3816 pcnetwork.exe Token: SeDebugPrivilege 3816 pcnetwork.exe Token: SeDebugPrivilege 1628 powershell.exe Token: SeIncreaseQuotaPrivilege 1628 powershell.exe Token: SeSecurityPrivilege 1628 powershell.exe Token: SeTakeOwnershipPrivilege 1628 powershell.exe Token: SeLoadDriverPrivilege 1628 powershell.exe Token: SeSystemProfilePrivilege 1628 powershell.exe Token: SeSystemtimePrivilege 1628 powershell.exe Token: SeProfSingleProcessPrivilege 1628 powershell.exe Token: SeIncBasePriorityPrivilege 1628 powershell.exe Token: SeCreatePagefilePrivilege 1628 powershell.exe Token: SeBackupPrivilege 1628 powershell.exe Token: SeRestorePrivilege 1628 powershell.exe Token: SeShutdownPrivilege 1628 powershell.exe Token: SeDebugPrivilege 1628 powershell.exe Token: SeSystemEnvironmentPrivilege 1628 powershell.exe Token: SeRemoteShutdownPrivilege 1628 powershell.exe Token: SeUndockPrivilege 1628 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3816 pcnetwork.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3516 wrote to memory of 1460 3516 windows.exe 74 PID 3516 wrote to memory of 1460 3516 windows.exe 74 PID 3516 wrote to memory of 1236 3516 windows.exe 78 PID 3516 wrote to memory of 1236 3516 windows.exe 78 PID 3516 wrote to memory of 1336 3516 windows.exe 80 PID 3516 wrote to memory of 1336 3516 windows.exe 80 PID 1336 wrote to memory of 1752 1336 cmd.exe 82 PID 1336 wrote to memory of 1752 1336 cmd.exe 82 PID 3816 wrote to memory of 1628 3816 pcnetwork.exe 83 PID 3816 wrote to memory of 1628 3816 pcnetwork.exe 83 PID 3816 wrote to memory of 1108 3816 pcnetwork.exe 85 PID 3816 wrote to memory of 1108 3816 pcnetwork.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\pcnetwork.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pcnetwork.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp87ED.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1752
-
-
-
C:\Windows\pcnetwork.exeC:\Windows\pcnetwork.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\pcnetwork.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pcnetwork.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
Filesize
1KB
MD5cbb99df7c06cb4ee33efb23ab2d9632c
SHA1bbe1bdc5831fb9fe11bd257048baa97460ab08b1
SHA2564a0351a64554b2a82e74185047ebe8e96341945b916828151932f8c5fd4cccdb
SHA5129e5e63491b0fdbffaee10b5edbd085c2ac704bb4daa27861a877cbe39115b01e07f7d3c669f6fe251e4f0e7126a6ef7bf6ef0741974e9659e04c94cedf7382bc
-
Filesize
1KB
MD5e6c2b5d6f2500ba83ec051d267e95e83
SHA1709113bb5fe75d419f59ac7096ec5659d6d74b69
SHA25659cb55fbd68d9794f9fe55eae508be0479a7c365eff3cb8615acd73cf25f7bd2
SHA51225b1c6d45931468dfe9ad8f38968271abf11ee4aecd51b5b709874d1fab622385ce71445b0150037147800ef1abe49fd8ac65318abd6d82bc2ab35b01bf1624d
-
Filesize
1KB
MD580a70e00ded60ba3aa405515bb9ac122
SHA18ead0496111b822b275813256e74fda7d6658dcb
SHA256c6748e30fabb8604b371964f7f013d3abd2e97a1815071299a6b0842d397dba9
SHA512b18a371553055e4c7a10dacf2868701b5270df0d0e79d08ef16bda1b30e77b8d413e258daa0d881fcc3b6abc2111066ae319b6013608cb530278d9c7d8102e77
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
159B
MD519a81520c9ba182d289c3555c1b51508
SHA16277dbd24335e39bdc8412498cad98f92bb44ae9
SHA256e571e83e8f2cd43dca47a08f20c95fe057d12c6dfe4753525b024f07c3e1c7a0
SHA51210b2f0b03a2997c8adcc676a2e32e76fd07c38312694cf4251a15a55de32b67808a03a9fea13603fae8b0b2de0ae197a332f6146006d8c29a67fe5b6ba047b93
-
Filesize
332KB
MD521b941b814ff8935b0f5b308a8c7ec9c
SHA1568e4c957b15f002eebb0bb291537e4c36c8f390
SHA256986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb
SHA512dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18