Analysis

  • max time kernel
    731s
  • max time network
    748s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 15:32

General

  • Target

    loader.exe

  • Size

    39KB

  • MD5

    de816c9a61a6a7dc3aaaf6bb4a951d0a

  • SHA1

    aab074feda312e521fee8b68e109ae1aeca04ded

  • SHA256

    0298ce15b89b28a28a55226b43f0c0fe0b5e7f73671a46f367a6ddc3c0c8750c

  • SHA512

    7073a6f81aa94e162a3786a7e5c1c5603287fad9f254bc69e4208350280e75614915875c99398f93d56e9cd13f8ce0affef1d3cf979a47d0103f2a3326c325a4

  • SSDEEP

    768:9NT0Woe2Nt0kyd2pwKuukUm2ufFWPt92GvW6dOMh+al6:9Npo7LZkewKuunsFe92Gu6dOMcN

Malware Config

Extracted

Family

xworm

Version

5.0

C2

does-moment.gl.at.ply.gg:6969

Mutex

XZpFX79rel5ZnFOb

Attributes
  • Install_directory

    %Public%

  • install_file

    Runtime Broker.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3212
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'loader.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4304
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2056
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4504

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          2e907f77659a6601fcc408274894da2e

          SHA1

          9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

          SHA256

          385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

          SHA512

          34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          ba169f4dcbbf147fe78ef0061a95e83b

          SHA1

          92a571a6eef49fff666e0f62a3545bcd1cdcda67

          SHA256

          5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

          SHA512

          8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          e91a049452029afa6defd4fa34646957

          SHA1

          d1ba5c6d30e79706a2f0e66caf405dd49d5d887a

          SHA256

          1a747cb87d49175fb29efbc8162ff99235769897873db2242a8194af72b77a95

          SHA512

          01901cb6e9a385e54a0759a54a6dffd98e152d5052cf371bc514c73b52c3a075edf2af1851a24ee1bb8a637c441895946df7aca4ac11cb36ca1237a69f972c66

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3dwyf33t.bbf.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/2056-44-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

          Filesize

          10.8MB

        • memory/2056-48-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

          Filesize

          10.8MB

        • memory/2056-46-0x000001BCF5CB0000-0x000001BCF5CC0000-memory.dmp

          Filesize

          64KB

        • memory/2056-45-0x000001BCF5CB0000-0x000001BCF5CC0000-memory.dmp

          Filesize

          64KB

        • memory/3212-13-0x0000023D1E4E0000-0x0000023D1E4F0000-memory.dmp

          Filesize

          64KB

        • memory/3212-14-0x0000023D1E4E0000-0x0000023D1E4F0000-memory.dmp

          Filesize

          64KB

        • memory/3212-17-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

          Filesize

          10.8MB

        • memory/3212-12-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

          Filesize

          10.8MB

        • memory/3212-7-0x0000023D1E650000-0x0000023D1E672000-memory.dmp

          Filesize

          136KB

        • memory/4304-29-0x000002879D5E0000-0x000002879D5F0000-memory.dmp

          Filesize

          64KB

        • memory/4304-19-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

          Filesize

          10.8MB

        • memory/4304-33-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

          Filesize

          10.8MB

        • memory/4304-30-0x000002879D5E0000-0x000002879D5F0000-memory.dmp

          Filesize

          64KB

        • memory/4504-64-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

          Filesize

          10.8MB

        • memory/4504-58-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

          Filesize

          10.8MB

        • memory/4504-60-0x00000179E1CC0000-0x00000179E1CD0000-memory.dmp

          Filesize

          64KB

        • memory/4504-59-0x00000179E1CC0000-0x00000179E1CD0000-memory.dmp

          Filesize

          64KB

        • memory/4504-62-0x00000179E1CC0000-0x00000179E1CD0000-memory.dmp

          Filesize

          64KB

        • memory/4952-0-0x0000000000820000-0x0000000000830000-memory.dmp

          Filesize

          64KB

        • memory/4952-1-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

          Filesize

          10.8MB

        • memory/4952-69-0x000000001B4B0000-0x000000001B4C0000-memory.dmp

          Filesize

          64KB

        • memory/4952-70-0x00007FFE27BA0000-0x00007FFE28661000-memory.dmp

          Filesize

          10.8MB

        • memory/4952-71-0x000000001B4B0000-0x000000001B4C0000-memory.dmp

          Filesize

          64KB