Analysis

  • max time kernel
    595s
  • max time network
    599s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 15:36

General

  • Target

    loader.exe

  • Size

    39KB

  • MD5

    de816c9a61a6a7dc3aaaf6bb4a951d0a

  • SHA1

    aab074feda312e521fee8b68e109ae1aeca04ded

  • SHA256

    0298ce15b89b28a28a55226b43f0c0fe0b5e7f73671a46f367a6ddc3c0c8750c

  • SHA512

    7073a6f81aa94e162a3786a7e5c1c5603287fad9f254bc69e4208350280e75614915875c99398f93d56e9cd13f8ce0affef1d3cf979a47d0103f2a3326c325a4

  • SSDEEP

    768:9NT0Woe2Nt0kyd2pwKuukUm2ufFWPt92GvW6dOMh+al6:9Npo7LZkewKuunsFe92Gu6dOMcN

Malware Config

Extracted

Family

xworm

Version

5.0

C2

does-moment.gl.at.ply.gg:6969

Mutex

XZpFX79rel5ZnFOb

Attributes
  • Install_directory

    %Public%

  • install_file

    Runtime Broker.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4048
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'loader.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1940
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:672

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          77d622bb1a5b250869a3238b9bc1402b

          SHA1

          d47f4003c2554b9dfc4c16f22460b331886b191b

          SHA256

          f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

          SHA512

          d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          10fb30dc297f99d6ebafa5fee8b24fa2

          SHA1

          76904509313a49a765edcde26b69c3a61f9fa225

          SHA256

          567bcacac120711fc04bf8e6c8cd0bff7b61e8ee0a6316254d1005ebb1264e6a

          SHA512

          c42ace1ea0923fa55592f4f486a508ea56997fdbe0200016b0fc16a33452fc28e4530129a315b3b3a5ede37a07097c13a0eb310c9e91e5d97bb7ce7b955b9498

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          98f841e438be7b74f893cd4f792676d9

          SHA1

          e0d05b9e78482a1cd58c036056cf21d5e873bbdd

          SHA256

          6864d2e5a9cb45d2fe4a2712bcc936f14dd77f966bfce8003bdb290ffb40d08b

          SHA512

          d1b38e6e5a624e857bdb6214cf52dbdbdda77734b38af80608acef71474b86f5d2c5123601509577c0ee449062ad25980ebfe3e9bd7051f176ef22fa76e6cbba

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_20qx1zmp.o33.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/672-65-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

          Filesize

          10.8MB

        • memory/672-63-0x000002032CEE0000-0x000002032CEF0000-memory.dmp

          Filesize

          64KB

        • memory/672-52-0x000002032CEE0000-0x000002032CEF0000-memory.dmp

          Filesize

          64KB

        • memory/672-51-0x000002032CEE0000-0x000002032CEF0000-memory.dmp

          Filesize

          64KB

        • memory/672-50-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

          Filesize

          10.8MB

        • memory/1940-34-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

          Filesize

          10.8MB

        • memory/1940-19-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

          Filesize

          10.8MB

        • memory/1940-20-0x000002C953350000-0x000002C953360000-memory.dmp

          Filesize

          64KB

        • memory/1940-32-0x000002C953350000-0x000002C953360000-memory.dmp

          Filesize

          64KB

        • memory/1940-21-0x000002C953350000-0x000002C953360000-memory.dmp

          Filesize

          64KB

        • memory/2356-49-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

          Filesize

          10.8MB

        • memory/2356-37-0x000002B0C0BA0000-0x000002B0C0BB0000-memory.dmp

          Filesize

          64KB

        • memory/2356-36-0x000002B0C0BA0000-0x000002B0C0BB0000-memory.dmp

          Filesize

          64KB

        • memory/2356-35-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

          Filesize

          10.8MB

        • memory/4048-2-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

          Filesize

          10.8MB

        • memory/4048-17-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

          Filesize

          10.8MB

        • memory/4048-3-0x000002F2F1050000-0x000002F2F1060000-memory.dmp

          Filesize

          64KB

        • memory/4048-10-0x000002F2F1050000-0x000002F2F1060000-memory.dmp

          Filesize

          64KB

        • memory/4048-4-0x000002F2F0F90000-0x000002F2F0FB2000-memory.dmp

          Filesize

          136KB

        • memory/4144-0-0x0000000000A40000-0x0000000000A50000-memory.dmp

          Filesize

          64KB

        • memory/4144-1-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

          Filesize

          10.8MB

        • memory/4144-70-0x0000000001340000-0x0000000001350000-memory.dmp

          Filesize

          64KB

        • memory/4144-71-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

          Filesize

          10.8MB

        • memory/4144-72-0x0000000001340000-0x0000000001350000-memory.dmp

          Filesize

          64KB