Analysis
- max time kernel
118s - max time network
146s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
28/03/2024, 09:24
General
- Target SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe
- Size 455KB
- Sample240328-lc2cbsfa73
- SHA256 a50078c294c3980c23fc8da34f3fd1dc8ca042e07e0f7f67696d7035ec84700d
Malware Config
Extracted
-
xworm
-
5.1
-
104.194.9.116:7000
-
bUezpCDHVjUVS3W9
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot6330888131:AAE5ycZdHuNqV5SVYhHeCfRENn6GuCjwXjs/sendMessage?chat_id=1046049845
Signatures
- Detect Xworm Payload 5 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 31 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2004 -s 7362⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2004-0-0x00000000002A0000-0x00000000002B6000-memory.dmp
memory/2004-1-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp
memory/2004-2-0x000000001B270000-0x000000001B2F0000-memory.dmp
memory/2004-3-0x0000000000650000-0x00000000006B4000-memory.dmp
memory/2004-17-0x000000001B270000-0x000000001B2F0000-memory.dmp
memory/2004-16-0x000007FEF53F0000-0x000007FEF5DDC000-memory.dmp
memory/2280-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2280-6-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2280-7-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2280-9-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2280-11-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2280-13-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2280-14-0x0000000074700000-0x0000000074DEE000-memory.dmp
memory/2280-15-0x0000000000D00000-0x0000000000D40000-memory.dmp
memory/2280-5-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2280-4-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2280-18-0x0000000074700000-0x0000000074DEE000-memory.dmp