Analysis
-
max time kernel
595s -
max time network
599s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 15:36
Behavioral task
behavioral1
Sample
loader.exe
Resource
win10v2004-20240226-en
General
-
Target
loader.exe
-
Size
39KB
-
MD5
de816c9a61a6a7dc3aaaf6bb4a951d0a
-
SHA1
aab074feda312e521fee8b68e109ae1aeca04ded
-
SHA256
0298ce15b89b28a28a55226b43f0c0fe0b5e7f73671a46f367a6ddc3c0c8750c
-
SHA512
7073a6f81aa94e162a3786a7e5c1c5603287fad9f254bc69e4208350280e75614915875c99398f93d56e9cd13f8ce0affef1d3cf979a47d0103f2a3326c325a4
-
SSDEEP
768:9NT0Woe2Nt0kyd2pwKuukUm2ufFWPt92GvW6dOMh+al6:9Npo7LZkewKuunsFe92Gu6dOMcN
Malware Config
Extracted
xworm
5.0
does-moment.gl.at.ply.gg:6969
XZpFX79rel5ZnFOb
-
Install_directory
%Public%
-
install_file
Runtime Broker.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/4144-0-0x0000000000A40000-0x0000000000A50000-memory.dmp family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation loader.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk loader.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk loader.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Public\\Runtime Broker.exe" loader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4048 powershell.exe 4048 powershell.exe 1940 powershell.exe 1940 powershell.exe 2356 powershell.exe 2356 powershell.exe 672 powershell.exe 672 powershell.exe 4144 loader.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4144 loader.exe Token: SeDebugPrivilege 4048 powershell.exe Token: SeDebugPrivilege 1940 powershell.exe Token: SeDebugPrivilege 2356 powershell.exe Token: SeDebugPrivilege 672 powershell.exe Token: SeDebugPrivilege 4144 loader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4144 loader.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4144 wrote to memory of 4048 4144 loader.exe 91 PID 4144 wrote to memory of 4048 4144 loader.exe 91 PID 4144 wrote to memory of 1940 4144 loader.exe 95 PID 4144 wrote to memory of 1940 4144 loader.exe 95 PID 4144 wrote to memory of 2356 4144 loader.exe 97 PID 4144 wrote to memory of 2356 4144 loader.exe 97 PID 4144 wrote to memory of 672 4144 loader.exe 100 PID 4144 wrote to memory of 672 4144 loader.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'loader.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD510fb30dc297f99d6ebafa5fee8b24fa2
SHA176904509313a49a765edcde26b69c3a61f9fa225
SHA256567bcacac120711fc04bf8e6c8cd0bff7b61e8ee0a6316254d1005ebb1264e6a
SHA512c42ace1ea0923fa55592f4f486a508ea56997fdbe0200016b0fc16a33452fc28e4530129a315b3b3a5ede37a07097c13a0eb310c9e91e5d97bb7ce7b955b9498
-
Filesize
944B
MD598f841e438be7b74f893cd4f792676d9
SHA1e0d05b9e78482a1cd58c036056cf21d5e873bbdd
SHA2566864d2e5a9cb45d2fe4a2712bcc936f14dd77f966bfce8003bdb290ffb40d08b
SHA512d1b38e6e5a624e857bdb6214cf52dbdbdda77734b38af80608acef71474b86f5d2c5123601509577c0ee449062ad25980ebfe3e9bd7051f176ef22fa76e6cbba
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82