Analysis
- max time kernel
269s - max time network
305s - platform
windows10-1703_x64 - resource
win10-20240319-en - resource tags
- submitted
29/03/2024, 01:56
General
- Target d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc.exe
- Size 4.8MB
- Sample240329-cc17wsfa98
- SHA256 d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc
Malware Config
Extracted
-
xworm
-
gamemodz.duckdns.org:1337
-
sweetchillz.duckdns.org:1337
-
<Xwormmm>:32524
-
Install_directory
%ProgramData%
-
install_file
update.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Detect ZGRat V1 35 IoCs
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 4 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Executes dropped EXE 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc.exe"C:\Users\Admin\AppData\Local\Temp\d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 15205⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 6285⤵
- Program crash
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
run.vbs
setup.exe
update.exe
memory/3204-9802-0x0000000071CD0000-0x00000000723BE000-memory.dmp
memory/3204-16-0x0000000000B00000-0x0000000000D66000-memory.dmp
memory/3204-77-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-69-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-19-0x0000000005550000-0x0000000005560000-memory.dmp
memory/3204-20-0x0000000071CD0000-0x00000000723BE000-memory.dmp
memory/3204-22-0x0000000005660000-0x00000000058BA000-memory.dmp
memory/3204-81-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-65-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-24-0x0000000005930000-0x0000000005B8A000-memory.dmp
memory/3204-26-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-85-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-28-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-2608-0x0000000005550000-0x0000000005560000-memory.dmp
memory/3204-60-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-73-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-31-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-35-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-2907-0x0000000071CD0000-0x00000000723BE000-memory.dmp
memory/3204-9794-0x0000000006040000-0x0000000006094000-memory.dmp
memory/3204-43-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-9793-0x00000000065D0000-0x0000000006ACE000-memory.dmp
memory/3204-9786-0x0000000005D80000-0x0000000005E18000-memory.dmp
memory/3204-48-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-52-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-9788-0x0000000005F80000-0x0000000005FCC000-memory.dmp
memory/3204-56-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/3204-9777-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/3204-39-0x0000000005930000-0x0000000005B84000-memory.dmp
memory/4712-9807-0x0000000071CD0000-0x00000000723BE000-memory.dmp
memory/4712-9817-0x0000000008E10000-0x0000000008E20000-memory.dmp
memory/4712-9808-0x00000000003E0000-0x00000000003F4000-memory.dmp
memory/4712-9809-0x0000000008B50000-0x0000000008BEC000-memory.dmp
memory/4712-9810-0x0000000001050000-0x00000000010B6000-memory.dmp
memory/4712-9811-0x0000000008E10000-0x0000000008E20000-memory.dmp
memory/4712-9816-0x0000000071CD0000-0x00000000723BE000-memory.dmp
memory/5068-25-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-78-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-74-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-70-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-82-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-66-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-86-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-2307-0x0000000071CD0000-0x00000000723BE000-memory.dmp
memory/5068-63-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-59-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-55-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-51-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-47-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-9791-0x00000000016A0000-0x00000000016A1000-memory.dmp
memory/5068-9792-0x0000000001980000-0x00000000019E0000-memory.dmp
memory/5068-44-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-40-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-36-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-9806-0x0000000071CD0000-0x00000000723BE000-memory.dmp
memory/5068-32-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-27-0x0000000005D20000-0x0000000005F3E000-memory.dmp
memory/5068-23-0x0000000005D20000-0x0000000005F44000-memory.dmp
memory/5068-21-0x0000000005A90000-0x0000000005CB2000-memory.dmp
memory/5068-18-0x0000000005980000-0x0000000005990000-memory.dmp
memory/5068-17-0x0000000071CD0000-0x00000000723BE000-memory.dmp
memory/5068-15-0x0000000000F70000-0x00000000011A0000-memory.dmp