Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
02/04/2024, 11:28
Static task
static1
Behavioral task
behavioral1
Sample
b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe
Resource
win7-20240319-en
General
-
Target
b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe
-
Size
7.0MB
-
MD5
6b47add2cf208a988c57c8f00461de0b
-
SHA1
cf9518f4bd3cf94ab7225423e4365f4a262a9c61
-
SHA256
b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07
-
SHA512
e2f5eb2e82ab1951e0bfe0994219ed676a71ccb9804be7ebbea42d9ad9596922c16600a101caccbbfd161b98fcc2d7b3e9591afb66e1878627f6cee0918b6a35
-
SSDEEP
196608:oA+bmZgkjTKD4C4+e4YcJE4AcnPmP99j+zE/k:oAEGZjTvC4EtAcPmPJ/
Malware Config
Extracted
xworm
210.246.215.82:7000
-
Install_directory
%ProgramData%
-
install_file
WindowsNT.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x000700000001220a-6.dat family_xworm behavioral1/memory/2920-7-0x0000000000870000-0x000000000088C000-memory.dmp family_xworm -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion xSpoofer-new.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion xSpoofer-new.exe -
Executes dropped EXE 8 IoCs
pid Process 2920 XClient.exe 2744 xSpoofer-new.exe 2756 xSpoofer-new.exe 2420 xSpoofer-new.exe 2176 xSpoofer-new.exe 2520 xSpoofer-new.exe 2820 xSpoofer-new.exe 2668 xSpoofer-new.exe -
Loads dropped DLL 3 IoCs
pid Process 2324 b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe 2744 xSpoofer-new.exe 2744 xSpoofer-new.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2744 set thread context of 2756 2744 xSpoofer-new.exe 31 PID 2744 set thread context of 2420 2744 xSpoofer-new.exe 33 PID 2744 set thread context of 2176 2744 xSpoofer-new.exe 35 PID 2744 set thread context of 2520 2744 xSpoofer-new.exe 37 PID 2744 set thread context of 2820 2744 xSpoofer-new.exe 39 PID 2744 set thread context of 2668 2744 xSpoofer-new.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2920 XClient.exe Token: SeDebugPrivilege 2744 xSpoofer-new.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2920 2324 b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe 28 PID 2324 wrote to memory of 2920 2324 b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe 28 PID 2324 wrote to memory of 2920 2324 b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe 28 PID 2324 wrote to memory of 2744 2324 b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe 29 PID 2324 wrote to memory of 2744 2324 b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe 29 PID 2324 wrote to memory of 2744 2324 b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe 29 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2756 2744 xSpoofer-new.exe 31 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2420 2744 xSpoofer-new.exe 33 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2176 2744 xSpoofer-new.exe 35 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2520 2744 xSpoofer-new.exe 37 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2820 2744 xSpoofer-new.exe 39 PID 2744 wrote to memory of 2668 2744 xSpoofer-new.exe 41 PID 2744 wrote to memory of 2668 2744 xSpoofer-new.exe 41 PID 2744 wrote to memory of 2668 2744 xSpoofer-new.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe"C:\Users\Admin\AppData\Local\Temp\b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe"C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exeC:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblAuthManager3⤵
- Executes dropped EXE
PID:2756
-
-
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exeC:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblGameSave3⤵
- Executes dropped EXE
PID:2420
-
-
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exeC:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxGipSvc3⤵
- Executes dropped EXE
PID:2176
-
-
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exeC:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxNetApiSvc3⤵
- Executes dropped EXE
PID:2520
-
-
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exeC:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop xboxgip3⤵
- Executes dropped EXE
PID:2820
-
-
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exeC:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblAuthManager3⤵
- Executes dropped EXE
PID:2668
-
-
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exeC:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblGameSave3⤵PID:2196
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5626eb43e3611e3217f8602f7b8206889
SHA1358935565a0a495a62559b204b7b41cbc365d8d9
SHA2563c468ad439464cebe619052e06cf797b296ab0d9bcf88d475fb5c9b42b489573
SHA512f4bf30eeadb557501362de71d4b6d58ab498d98e52b453f6e20309da36fe288d098dab9bb08cfcecf12787536ff20f0e649401ab6b0ff75e6671a4f3ebc4cd29
-
Filesize
6.8MB
MD5233320478ce264f9e08d249244dc4fdb
SHA1af46758a7c39b4edf4b5b0819f732abb5ad19e17
SHA256edb57df920f62e6f1241695f8a46e420f104455a54fe91431db545834fd8d5ba
SHA512b1c06e96cbabd58f8489a18c8c270718cea634a9bbd4fd67786cd5d31cfa475d4f97e2389f1ce2b5ddf10db9687b5cb5361e878d29427f9670f59343468d5967