Analysis
- max time kernel
77s - max time network
103s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
15/03/2024, 01:27
General
- Target sus_protected.exe
- Size 105KB
- Sample240315-bveaeafc32
- SHA256 f730bbdf76ecc7e6a3cbc22516b2f66e6ce1bc0ff79f86fb651a9caa9020dba2
Malware Config
Extracted
-
xworm
-
hai1723rat-60039.portmap.io:60039
Signatures
- Detect Xworm Payload 1 IoCs
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sus_protected.exe"C:\Users\Admin\AppData\Local\Temp\sus_protected.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '113';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '113' -Value '"C:\Users\Admin\Desktop\lmao\nice.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\sus_protected.exe#cmd2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sus_protected.exe#cmd2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sus_protected.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sus_protected.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 19883⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_vaicczjz.sc1.ps1
memory/948-11-0x0000000073270000-0x000000007395E000-memory.dmp
memory/948-762-0x00000000056C0000-0x00000000056D0000-memory.dmp
memory/948-768-0x0000000007A50000-0x0000000007A9B000-memory.dmp
memory/948-767-0x0000000007570000-0x00000000078C0000-memory.dmp
memory/948-515-0x0000000073270000-0x000000007395E000-memory.dmp
memory/948-12-0x00000000054B0000-0x000000000554C000-memory.dmp
memory/948-766-0x0000000007420000-0x000000000753E000-memory.dmp
memory/948-765-0x00000000056C0000-0x00000000056D0000-memory.dmp
memory/948-764-0x00000000063C0000-0x00000000063CA000-memory.dmp
memory/948-7-0x0000000000400000-0x0000000000418000-memory.dmp
memory/948-763-0x0000000006960000-0x00000000069F2000-memory.dmp
memory/2316-4-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
memory/2316-0-0x0000000073270000-0x000000007395E000-memory.dmp
memory/2316-2-0x00000000050D0000-0x00000000055CE000-memory.dmp
memory/2316-13-0x0000000073270000-0x000000007395E000-memory.dmp
memory/2316-1-0x00000000003F0000-0x0000000000410000-memory.dmp
memory/2956-761-0x0000000073270000-0x000000007395E000-memory.dmp
memory/2956-550-0x0000000007080000-0x0000000007090000-memory.dmp
memory/2956-545-0x00000000739F0000-0x0000000073A3B000-memory.dmp
memory/2956-544-0x000000007E050000-0x000000007E060000-memory.dmp
memory/2956-525-0x0000000007080000-0x0000000007090000-memory.dmp
memory/2956-520-0x0000000073270000-0x000000007395E000-memory.dmp
memory/2956-521-0x0000000007080000-0x0000000007090000-memory.dmp
memory/4200-19-0x0000000007830000-0x0000000007896000-memory.dmp
memory/4200-21-0x0000000008460000-0x000000000847C000-memory.dmp
memory/4200-63-0x0000000009970000-0x0000000009A15000-memory.dmp
memory/4200-64-0x0000000007270000-0x0000000007280000-memory.dmp
memory/4200-67-0x0000000009B50000-0x0000000009BE4000-memory.dmp
memory/4200-8-0x0000000004C50000-0x0000000004C86000-memory.dmp
memory/4200-9-0x0000000073270000-0x000000007395E000-memory.dmp
memory/4200-15-0x00000000078B0000-0x0000000007ED8000-memory.dmp
memory/4200-427-0x0000000073270000-0x000000007395E000-memory.dmp
memory/4200-14-0x0000000007270000-0x0000000007280000-memory.dmp
memory/4200-16-0x0000000007270000-0x0000000007280000-memory.dmp
memory/4200-498-0x0000000009AE0000-0x0000000009AFA000-memory.dmp
memory/4200-499-0x0000000009BF0000-0x0000000009C12000-memory.dmp
memory/4200-17-0x00000000074B0000-0x00000000074D2000-memory.dmp
memory/4200-47-0x00000000739F0000-0x0000000073A3B000-memory.dmp
memory/4200-46-0x0000000009630000-0x0000000009663000-memory.dmp
memory/4200-518-0x0000000007270000-0x0000000007280000-memory.dmp
memory/4200-45-0x000000007EE60000-0x000000007EE70000-memory.dmp
memory/4200-18-0x0000000007750000-0x00000000077B6000-memory.dmp
memory/4200-20-0x0000000008070000-0x00000000083C0000-memory.dmp
memory/4200-523-0x0000000007270000-0x0000000007280000-memory.dmp
memory/4200-56-0x0000000009610000-0x000000000962E000-memory.dmp
memory/4200-526-0x0000000073270000-0x000000007395E000-memory.dmp
memory/4200-23-0x0000000008850000-0x00000000088C6000-memory.dmp
memory/4200-22-0x0000000008480000-0x00000000084CB000-memory.dmp
memory/4892-38-0x0000000073270000-0x000000007395E000-memory.dmp
memory/4892-39-0x0000000004360000-0x0000000004370000-memory.dmp
memory/4892-40-0x0000000004360000-0x0000000004370000-memory.dmp
memory/4892-509-0x0000000073270000-0x000000007395E000-memory.dmp
memory/4892-473-0x0000000006B10000-0x0000000006B18000-memory.dmp
memory/4892-464-0x0000000006B20000-0x0000000006B3A000-memory.dmp
memory/4892-110-0x0000000004360000-0x0000000004370000-memory.dmp
memory/4892-91-0x000000007EBE0000-0x000000007EBF0000-memory.dmp
memory/4892-93-0x00000000739F0000-0x0000000073A3B000-memory.dmp