Analysis
- max time kernel
314s - max time network
1575s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
31/03/2024, 13:24
General
- Target Cobra (2).rar
- Size 98.6MB
- Sample240331-qnrpgscd41
- SHA256 75c9353529159326f6d57a331386bb1e460d8806d57711fcff8d133214ce8ba1
Malware Config
Extracted
-
xworm
-
147.78.103.53:2723
-
Install_directory
%AppData%
-
install_file
CraxsRat.exe
-
telegram
https://api.telegram.org/bot7165460947:AAH6f591Qm_-opaAI0oIFjzcZwmJpJlI7Ek/sendMessage?chat_id=5169736402
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 10 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Cobra (2).rar"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Cobra (2).rar"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Cobra\1 Cpbra Rat Key Loder.exe"C:\Users\Admin\Desktop\Cobra\1 Cpbra Rat Key Loder.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Cobra\Cobra RAT_protected.exe"C:\Users\Admin\Desktop\Cobra\Cobra RAT_protected.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 31322⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
1 Cpbra Rat Key Loder.exe
Cobra RAT_protected.exe
DrakeUI.Framework.dll
LiveCharts.Wpf.dll
Pass.inf
-1.ico
AD.ico
AE.ico
AF.ico
AG.ico
AI.ico
AL.ico
AM.ico
AN.ico
AO.ico
AQ.ico
AR.ico
AS.ico
AT.ico
AU.ico
AW.ico
AX.ico
AZ.ico
BA.ico
BB.ico
BD.ico
BE.ico
BF.ico
BG.ico
BH.ico
BI.ico
BJ.ico
BL.ico
BM.ico
BN.ico
BO.ico
BR.ico
BS.ico
BT.ico
BW.ico
BY.ico
BZ.ico
CA.ico
CC.ico
CD.ico
CF.ico
CG.ico
GeoIP.dat
GeoIPCity.dat
GeoIPCitys.dll
LiveCharts.WinForms.dll
LiveCharts.dll
memory/3708-736-0x00000000098C0000-0x00000000098CC000-memory.dmp
memory/3708-726-0x0000000000870000-0x0000000004F70000-memory.dmp
memory/3708-741-0x0000000009DF0000-0x0000000009E2C000-memory.dmp
memory/3708-745-0x000000000A440000-0x000000000A46C000-memory.dmp
memory/3708-746-0x00000000097D0000-0x00000000097E0000-memory.dmp
memory/3708-750-0x000000000B780000-0x000000000B926000-memory.dmp
memory/3708-755-0x0000000016DC0000-0x0000000016DF6000-memory.dmp
memory/3708-732-0x00000000099E0000-0x0000000009A36000-memory.dmp
memory/3708-731-0x00000000097E0000-0x00000000097EA000-memory.dmp
memory/3708-730-0x0000000009940000-0x00000000099D2000-memory.dmp
memory/3708-729-0x0000000009E40000-0x000000000A33E000-memory.dmp
memory/3708-728-0x0000000009820000-0x00000000098BC000-memory.dmp
memory/3708-727-0x0000000000870000-0x0000000004F70000-memory.dmp
memory/3708-737-0x0000000009D90000-0x0000000009DAC000-memory.dmp
memory/3708-806-0x0000000077130000-0x00000000772F2000-memory.dmp
memory/3708-721-0x0000000077130000-0x00000000772F2000-memory.dmp
memory/3708-720-0x0000000077130000-0x00000000772F2000-memory.dmp
memory/3708-719-0x0000000077130000-0x00000000772F2000-memory.dmp
memory/3708-718-0x0000000077130000-0x00000000772F2000-memory.dmp
memory/3708-804-0x0000000077130000-0x00000000772F2000-memory.dmp
memory/3708-802-0x0000000011980000-0x00000000119E6000-memory.dmp
memory/4200-801-0x00007FFE34370000-0x00007FFE34D5C000-memory.dmp
memory/4200-714-0x0000000000870000-0x00000000008BC000-memory.dmp
memory/4200-715-0x00007FFE34370000-0x00007FFE34D5C000-memory.dmp
memory/4200-722-0x00000000010A0000-0x00000000010B0000-memory.dmp