Analysis

  • max time kernel
    163s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-03-2024 02:40

General

  • Target

    585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815.exe

  • Size

    419KB

  • MD5

    8a716466aa6f2d425ec09770626e8e54

  • SHA1

    62fb757ea5098651331f91c1664db9fe46b21879

  • SHA256

    585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815

  • SHA512

    54f11067e400347834689b4532ae53b00ec96a3ca90a2c21de27942f4ca30306fdda0522c1a3a4cde047ad650162e2d8313205220acaab4cc60e010965690940

  • SSDEEP

    6144:QTCsE3O4yuS5O0RBOInaCa6G6ypdf4Bf7e/DnjBeq04fVXOUvE0CGsSE9BLM:2E3O5uOO0mInnGZCTS84fZLtw

Malware Config

Extracted

Family

xworm

Version

5.0

C2

5.182.87.154:7000

Mutex

VMFidhoqn75fm5lJ

Attributes
  • Install_directory

    %Temp%

  • install_file

    mdnsresp.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects executables packed with SmartAssembly 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815.exe
    "C:\Users\Admin\AppData\Local\Temp\585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANQA4ADUAZAAxAGYAYgA0AGYAMgA4ADgAOQA3ADQAYgA2ADgAMwBjADUAYQBiAGYAYgAxADAAYwA5ADcAZAA3AGQAMgBhAGUAMwBmADUAOQBjADIAYgBjAGYAZAA3ADgAYgBhADIANwAyAGUAMwBiAGUAMgBjAGQANwA4ADEANQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAANQA4ADUAZAAxAGYAYgA0AGYAMgA4ADgAOQA3ADQAYgA2ADgAMwBjADUAYQBiAGYAYgAxADAAYwA5ADcAZAA3AGQAMgBhAGUAMwBmADUAOQBjADIAYgBjAGYAZAA3ADgAYgBhADIANwAyAGUAMwBiAGUAMgBjAGQANwA4ADEANQAuAGUAeABlADsA
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3264
    • C:\Users\Admin\AppData\Local\Temp\585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815.exe
      C:\Users\Admin\AppData\Local\Temp\585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815.exe
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2748
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1544
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mdnsresp.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3444
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mdnsresp.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815.exe.log

    Filesize

    1KB

    MD5

    8c2da65103d6b46d8cf610b118210cf0

    SHA1

    9db4638340bb74f2af3161cc2c9c0b8b32e6ab65

    SHA256

    0e48e2efd419951e0eb9a8d942493cfdf5540d1d19ff9dae6f145fb3ebcbeeac

    SHA512

    3cf5a125276e264cd8478f2b92d3848fb68b96d46eb4a39e650d09df02068c274881a1c314cdfbfdcb452672fb70dd8becf3ffe9562d39919d9c4d6b07fbb614

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    3d086a433708053f9bf9523e1d87a4e8

    SHA1

    b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

    SHA256

    6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

    SHA512

    931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    4d745ee879a625891be21c705f4d281a

    SHA1

    a7bd27d859b462e7d21d8b9f6a3ce66b9dbd2e08

    SHA256

    52ab3c1d6f2b85b5d1a2d93c87848522cb01fa67311675be6a6daf03f0e7b814

    SHA512

    2fb78a9d7947ec2b02a7a91ebd0adf2bd7c8a52b97a07d27b2edc25f18c1493d180ae0293080e2d3a191b8e358a01e1aa99f192e6b2234b564e6df89f1badfe8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    2089b2699a81b97383732345fc315b84

    SHA1

    4dedf5e3c85b48ac071ea47e3f2102d43a3912e0

    SHA256

    4246c58639ac921bf67e783b18d87195744d745d9034125850095b73e47eb6da

    SHA512

    a38985cb00cc0ccf82175d870343ac56d4cf61d4defc6caa660f8f27c9b17618bad4f64e7226ec1b0367469118c401cc92d80c40554b2a8d32c6d96d498eeb80

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    f650e7407077df0d7e1b0f8f5993efc5

    SHA1

    a8a5f0f72d682d09d8225a4c16acce8f3b9b1881

    SHA256

    ec02ed6338650d3765aed09d73af3d5c1c19157822843511eaa16a0f7ae4efa2

    SHA512

    067e91fc6d616fa35cfb6bf7f56347ea3c5242bff597c337922e93399de23db6c05116d5e56d33c127ec2a9d1bbb59b002be4cdd224596833f851a034658656a

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fnm03lzd.tcl.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1544-90-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/1544-105-0x0000000070310000-0x000000007035C000-memory.dmp

    Filesize

    304KB

  • memory/1544-91-0x0000000002590000-0x00000000025A0000-memory.dmp

    Filesize

    64KB

  • memory/1544-116-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/1544-104-0x0000000002590000-0x00000000025A0000-memory.dmp

    Filesize

    64KB

  • memory/1544-102-0x00000000057C0000-0x0000000005B14000-memory.dmp

    Filesize

    3.3MB

  • memory/2536-147-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2648-16-0x0000000005720000-0x00000000057BC000-memory.dmp

    Filesize

    624KB

  • memory/2648-14-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2648-10-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2648-92-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2748-35-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2748-85-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/2748-81-0x0000000007E50000-0x0000000007E6A000-memory.dmp

    Filesize

    104KB

  • memory/2748-67-0x0000000070310000-0x000000007035C000-memory.dmp

    Filesize

    304KB

  • memory/2748-66-0x000000007F780000-0x000000007F790000-memory.dmp

    Filesize

    64KB

  • memory/2748-64-0x0000000005310000-0x0000000005320000-memory.dmp

    Filesize

    64KB

  • memory/2748-37-0x0000000005310000-0x0000000005320000-memory.dmp

    Filesize

    64KB

  • memory/2748-36-0x0000000005310000-0x0000000005320000-memory.dmp

    Filesize

    64KB

  • memory/3264-18-0x0000000004820000-0x0000000004830000-memory.dmp

    Filesize

    64KB

  • memory/3264-17-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/3264-33-0x0000000005C90000-0x0000000005CAE000-memory.dmp

    Filesize

    120KB

  • memory/3264-32-0x0000000005770000-0x0000000005AC4000-memory.dmp

    Filesize

    3.3MB

  • memory/3264-47-0x0000000004820000-0x0000000004830000-memory.dmp

    Filesize

    64KB

  • memory/3264-48-0x000000007F1C0000-0x000000007F1D0000-memory.dmp

    Filesize

    64KB

  • memory/3264-49-0x0000000006260000-0x0000000006292000-memory.dmp

    Filesize

    200KB

  • memory/3264-50-0x0000000070310000-0x000000007035C000-memory.dmp

    Filesize

    304KB

  • memory/3264-60-0x0000000006230000-0x000000000624E000-memory.dmp

    Filesize

    120KB

  • memory/3264-61-0x00000000062B0000-0x0000000006353000-memory.dmp

    Filesize

    652KB

  • memory/3264-62-0x00000000075F0000-0x0000000007C6A000-memory.dmp

    Filesize

    6.5MB

  • memory/3264-63-0x0000000006FB0000-0x0000000006FCA000-memory.dmp

    Filesize

    104KB

  • memory/3264-27-0x0000000005600000-0x0000000005666000-memory.dmp

    Filesize

    408KB

  • memory/3264-65-0x0000000007020000-0x000000000702A000-memory.dmp

    Filesize

    40KB

  • memory/3264-21-0x0000000005490000-0x00000000054F6000-memory.dmp

    Filesize

    408KB

  • memory/3264-20-0x0000000004CC0000-0x0000000004CE2000-memory.dmp

    Filesize

    136KB

  • memory/3264-77-0x0000000007230000-0x00000000072C6000-memory.dmp

    Filesize

    600KB

  • memory/3264-78-0x00000000071B0000-0x00000000071C1000-memory.dmp

    Filesize

    68KB

  • memory/3264-79-0x00000000071E0000-0x00000000071EE000-memory.dmp

    Filesize

    56KB

  • memory/3264-80-0x00000000071F0000-0x0000000007204000-memory.dmp

    Filesize

    80KB

  • memory/3264-19-0x0000000004E60000-0x0000000005488000-memory.dmp

    Filesize

    6.2MB

  • memory/3264-82-0x00000000072D0000-0x00000000072D8000-memory.dmp

    Filesize

    32KB

  • memory/3264-89-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/3264-34-0x0000000005D30000-0x0000000005D7C000-memory.dmp

    Filesize

    304KB

  • memory/3264-13-0x00000000046B0000-0x00000000046E6000-memory.dmp

    Filesize

    216KB

  • memory/3444-119-0x00000000056B0000-0x00000000056C0000-memory.dmp

    Filesize

    64KB

  • memory/3444-7-0x0000000005810000-0x0000000005840000-memory.dmp

    Filesize

    192KB

  • memory/3444-15-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/3444-130-0x0000000006F90000-0x0000000006FDC000-memory.dmp

    Filesize

    304KB

  • memory/3444-3-0x0000000005720000-0x00000000057B2000-memory.dmp

    Filesize

    584KB

  • memory/3444-6-0x00000000057C0000-0x0000000005808000-memory.dmp

    Filesize

    288KB

  • memory/3444-5-0x00000000056A0000-0x00000000056AA000-memory.dmp

    Filesize

    40KB

  • memory/3444-4-0x0000000005870000-0x0000000005880000-memory.dmp

    Filesize

    64KB

  • memory/3444-117-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/3444-118-0x00000000056B0000-0x00000000056C0000-memory.dmp

    Filesize

    64KB

  • memory/3444-0-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/3444-9-0x00000000058D0000-0x000000000591C000-memory.dmp

    Filesize

    304KB

  • memory/3444-8-0x0000000005880000-0x00000000058B0000-memory.dmp

    Filesize

    192KB

  • memory/3444-131-0x00000000056B0000-0x00000000056C0000-memory.dmp

    Filesize

    64KB

  • memory/3444-132-0x0000000070460000-0x00000000704AC000-memory.dmp

    Filesize

    304KB

  • memory/3444-142-0x0000000007CC0000-0x0000000007D63000-memory.dmp

    Filesize

    652KB

  • memory/3444-143-0x0000000007F40000-0x0000000007F51000-memory.dmp

    Filesize

    68KB

  • memory/3444-144-0x0000000007F70000-0x0000000007F84000-memory.dmp

    Filesize

    80KB

  • memory/3444-146-0x0000000074500000-0x0000000074CB0000-memory.dmp

    Filesize

    7.7MB

  • memory/3444-2-0x0000000005C30000-0x00000000061D4000-memory.dmp

    Filesize

    5.6MB

  • memory/3444-1-0x0000000000C30000-0x0000000000CA0000-memory.dmp

    Filesize

    448KB