Analysis

  • max time kernel
    727s
  • max time network
    748s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 16:34

General

  • Target

    wtf.exe

  • Size

    216KB

  • MD5

    9924acedacbac2b37e1569d187cb84f3

  • SHA1

    6d55973b341ffc579cc9fe9741a9a294aacfa7e4

  • SHA256

    a1bbc7ce33e95d187c6d8ccd8fd27c0a01025e2d3c408bee8821daf83ab464ee

  • SHA512

    9d46581ab32b632b1e0ef3758725628ac1854c457c886a978b0f62e7127ff88447dcac1e2d2c3de136501ad79721c914cebbecad620e3a36606d3d0386e8face

  • SSDEEP

    3072:SNpAeiFe92dOMFFxIghku1ILePsjaUTs18T2oceo3ziwWBWLkkkKvhVm4ESk59o9:See9qpymOeLKsc2jeLwxkkk09ESk5

Malware Config

Extracted

Family

xworm

Version

5.0

C2

does-moment.gl.at.ply.gg:6969

Mutex

COWvjV730xSBTMoz

Attributes
  • Install_directory

    %Public%

  • install_file

    Runtime Broker.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\wtf.exe
    "C:\Users\Admin\AppData\Local\Temp\wtf.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\wtf.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4048
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wtf.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5040
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Runtime Broker.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2040
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4336
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4272

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            cadef9abd087803c630df65264a6c81c

            SHA1

            babbf3636c347c8727c35f3eef2ee643dbcc4bd2

            SHA256

            cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

            SHA512

            7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            6b62626c9199f4688488fc54a3c44277

            SHA1

            2ad24e90c73e200c49eab2a74bf93b2c4e357686

            SHA256

            2c4d975787bde30963988a0a87f0b02e10c695ea795896f640169491a52884b8

            SHA512

            d8856a30fe27a90d4366850313fe1f8ff61733df37e0cc49d15e3b51336d1a786f25813f90e90e894fbe4fba6352a57523f7fd0a9724f4b075a511686777459a

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            dd1d0b083fedf44b482a028fb70b96e8

            SHA1

            dc9c027937c9f6d52268a1504cbae42a39c8d36a

            SHA256

            cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c

            SHA512

            96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_smjrsu2e.b44.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/1448-87-0x000000001B040000-0x000000001B050000-memory.dmp

            Filesize

            64KB

          • memory/1448-73-0x000000001B040000-0x000000001B050000-memory.dmp

            Filesize

            64KB

          • memory/1448-78-0x000000001B040000-0x000000001B050000-memory.dmp

            Filesize

            64KB

          • memory/1448-0-0x0000000000300000-0x000000000033C000-memory.dmp

            Filesize

            240KB

          • memory/1448-96-0x000000001B040000-0x000000001B050000-memory.dmp

            Filesize

            64KB

          • memory/1448-1-0x00007FFD5FF20000-0x00007FFD609E1000-memory.dmp

            Filesize

            10.8MB

          • memory/1448-46-0x00007FFD5FF20000-0x00007FFD609E1000-memory.dmp

            Filesize

            10.8MB

          • memory/2040-52-0x00007FFD5FF20000-0x00007FFD609E1000-memory.dmp

            Filesize

            10.8MB

          • memory/2040-50-0x0000022D66950000-0x0000022D66960000-memory.dmp

            Filesize

            64KB

          • memory/2040-49-0x0000022D66950000-0x0000022D66960000-memory.dmp

            Filesize

            64KB

          • memory/2040-47-0x0000022D66950000-0x0000022D66960000-memory.dmp

            Filesize

            64KB

          • memory/2040-36-0x00007FFD5FF20000-0x00007FFD609E1000-memory.dmp

            Filesize

            10.8MB

          • memory/4048-18-0x00007FFD5FF20000-0x00007FFD609E1000-memory.dmp

            Filesize

            10.8MB

          • memory/4048-15-0x000001F6DEB30000-0x000001F6DEB40000-memory.dmp

            Filesize

            64KB

          • memory/4048-11-0x00007FFD5FF20000-0x00007FFD609E1000-memory.dmp

            Filesize

            10.8MB

          • memory/4048-12-0x000001F6DEB30000-0x000001F6DEB40000-memory.dmp

            Filesize

            64KB

          • memory/4048-13-0x000001F6DEAF0000-0x000001F6DEB12000-memory.dmp

            Filesize

            136KB

          • memory/4048-14-0x000001F6DEB30000-0x000001F6DEB40000-memory.dmp

            Filesize

            64KB

          • memory/4336-66-0x000001D082BE0000-0x000001D082BF0000-memory.dmp

            Filesize

            64KB

          • memory/4336-64-0x000001D082BE0000-0x000001D082BF0000-memory.dmp

            Filesize

            64KB

          • memory/4336-58-0x00007FFD5FF20000-0x00007FFD609E1000-memory.dmp

            Filesize

            10.8MB

          • memory/4336-63-0x000001D082BE0000-0x000001D082BF0000-memory.dmp

            Filesize

            64KB

          • memory/4336-68-0x00007FFD5FF20000-0x00007FFD609E1000-memory.dmp

            Filesize

            10.8MB

          • memory/5040-35-0x00007FFD5FF20000-0x00007FFD609E1000-memory.dmp

            Filesize

            10.8MB

          • memory/5040-20-0x00007FFD5FF20000-0x00007FFD609E1000-memory.dmp

            Filesize

            10.8MB

          • memory/5040-21-0x00000247362B0000-0x00000247362C0000-memory.dmp

            Filesize

            64KB

          • memory/5040-32-0x00000247362B0000-0x00000247362C0000-memory.dmp

            Filesize

            64KB

          • memory/5040-33-0x00000247362B0000-0x00000247362C0000-memory.dmp

            Filesize

            64KB