Analysis

  • max time kernel
    165s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2024, 11:28

General

  • Target

    b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe

  • Size

    7.0MB

  • MD5

    6b47add2cf208a988c57c8f00461de0b

  • SHA1

    cf9518f4bd3cf94ab7225423e4365f4a262a9c61

  • SHA256

    b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07

  • SHA512

    e2f5eb2e82ab1951e0bfe0994219ed676a71ccb9804be7ebbea42d9ad9596922c16600a101caccbbfd161b98fcc2d7b3e9591afb66e1878627f6cee0918b6a35

  • SSDEEP

    196608:oA+bmZgkjTKD4C4+e4YcJE4AcnPmP99j+zE/k:oAEGZjTvC4EtAcPmPJ/

Malware Config

Extracted

Family

xworm

C2

210.246.215.82:7000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    WindowsNT.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 19 IoCs
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe
    "C:\Users\Admin\AppData\Local\Temp\b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      "C:\Users\Admin\AppData\Roaming\XClient.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4952
    • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
      "C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblAuthManager
        3⤵
        • Executes dropped EXE
        PID:4724
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblGameSave
        3⤵
        • Executes dropped EXE
        PID:1996
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxGipSvc
        3⤵
        • Executes dropped EXE
        PID:868
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxNetApiSvc
        3⤵
        • Executes dropped EXE
        PID:3504
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop xboxgip
        3⤵
        • Executes dropped EXE
        PID:3116
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblAuthManager
        3⤵
        • Executes dropped EXE
        PID:532
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblGameSave
        3⤵
        • Executes dropped EXE
        PID:5112
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XboxNetApiSvc
        3⤵
        • Executes dropped EXE
        PID:4576
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XboxGipSvc
        3⤵
        • Executes dropped EXE
        PID:4944
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete xboxgip
        3⤵
        • Executes dropped EXE
        PID:4416
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop vgk
        3⤵
        • Executes dropped EXE
        PID:2568
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\xbgm" /f
        3⤵
        • Executes dropped EXE
        PID:3288
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f
        3⤵
        • Executes dropped EXE
        PID:4800
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /disable
        3⤵
        • Executes dropped EXE
        PID:3588
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe /Change /TN "Microsoft\XblGameSave\XblGameSaveTaskLogon" /disableL
        3⤵
        • Executes dropped EXE
        PID:488
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe -Command "& {Get-AppxPackage -allusers *xbox* | Remove-AppxPackage}"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1048
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:560

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kriwovka.zfs.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Roaming\XClient.exe

          Filesize

          87KB

          MD5

          626eb43e3611e3217f8602f7b8206889

          SHA1

          358935565a0a495a62559b204b7b41cbc365d8d9

          SHA256

          3c468ad439464cebe619052e06cf797b296ab0d9bcf88d475fb5c9b42b489573

          SHA512

          f4bf30eeadb557501362de71d4b6d58ab498d98e52b453f6e20309da36fe288d098dab9bb08cfcecf12787536ff20f0e649401ab6b0ff75e6671a4f3ebc4cd29

        • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe

          Filesize

          6.8MB

          MD5

          233320478ce264f9e08d249244dc4fdb

          SHA1

          af46758a7c39b4edf4b5b0819f732abb5ad19e17

          SHA256

          edb57df920f62e6f1241695f8a46e420f104455a54fe91431db545834fd8d5ba

          SHA512

          b1c06e96cbabd58f8489a18c8c270718cea634a9bbd4fd67786cd5d31cfa475d4f97e2389f1ce2b5ddf10db9687b5cb5361e878d29427f9670f59343468d5967

        • memory/488-139-0x0000000140000000-0x000000014003E000-memory.dmp

          Filesize

          248KB

        • memory/488-168-0x0000000140000000-0x000000014003E000-memory.dmp

          Filesize

          248KB

        • memory/532-79-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/532-81-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/532-77-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/560-206-0x0000000140000000-0x0000000140AE7000-memory.dmp

          Filesize

          10.9MB

        • memory/560-187-0x0000000140000000-0x0000000140AE7000-memory.dmp

          Filesize

          10.9MB

        • memory/560-207-0x00000174B2090000-0x00000174B2091000-memory.dmp

          Filesize

          4KB

        • memory/560-210-0x0000000140000000-0x0000000140AE7000-memory.dmp

          Filesize

          10.9MB

        • memory/560-211-0x0000000140000000-0x0000000140AE7000-memory.dmp

          Filesize

          10.9MB

        • memory/868-49-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/868-55-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/868-54-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/868-52-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/868-51-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/1048-147-0x0000000140000000-0x0000000140071000-memory.dmp

          Filesize

          452KB

        • memory/1048-166-0x000001BE754A0000-0x000001BE754C6000-memory.dmp

          Filesize

          152KB

        • memory/1048-153-0x00007FFD4A380000-0x00007FFD4AE41000-memory.dmp

          Filesize

          10.8MB

        • memory/1048-156-0x000001BE5C410000-0x000001BE5C420000-memory.dmp

          Filesize

          64KB

        • memory/1048-155-0x000001BE5C410000-0x000001BE5C420000-memory.dmp

          Filesize

          64KB

        • memory/1048-161-0x000001BE5C420000-0x000001BE5C442000-memory.dmp

          Filesize

          136KB

        • memory/1048-162-0x000001BE5C410000-0x000001BE5C420000-memory.dmp

          Filesize

          64KB

        • memory/1048-164-0x000001BE750B0000-0x000001BE750C6000-memory.dmp

          Filesize

          88KB

        • memory/1048-165-0x000001BE750A0000-0x000001BE750AA000-memory.dmp

          Filesize

          40KB

        • memory/1048-170-0x00007FFD4A380000-0x00007FFD4AE41000-memory.dmp

          Filesize

          10.8MB

        • memory/1048-181-0x0000000140000000-0x0000000140071000-memory.dmp

          Filesize

          452KB

        • memory/1048-180-0x00007FFD4A380000-0x00007FFD4AE41000-memory.dmp

          Filesize

          10.8MB

        • memory/1048-177-0x000001BE5C410000-0x000001BE5C420000-memory.dmp

          Filesize

          64KB

        • memory/1048-174-0x000001BE5C410000-0x000001BE5C420000-memory.dmp

          Filesize

          64KB

        • memory/1048-173-0x000001BE5C410000-0x000001BE5C420000-memory.dmp

          Filesize

          64KB

        • memory/1048-169-0x000001BE5C410000-0x000001BE5C420000-memory.dmp

          Filesize

          64KB

        • memory/1048-171-0x000001BE5C410000-0x000001BE5C420000-memory.dmp

          Filesize

          64KB

        • memory/1576-68-0x00007FF622060000-0x00007FF622B50000-memory.dmp

          Filesize

          10.9MB

        • memory/1576-71-0x00007FFD68AB0000-0x00007FFD68CA5000-memory.dmp

          Filesize

          2.0MB

        • memory/1576-29-0x00007FFD68AB0000-0x00007FFD68CA5000-memory.dmp

          Filesize

          2.0MB

        • memory/1576-26-0x00007FF622060000-0x00007FF622B50000-memory.dmp

          Filesize

          10.9MB

        • memory/1996-40-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/1996-42-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/1996-45-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/1996-44-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/1996-46-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/2420-0-0x0000000000EE0000-0x00000000015EE000-memory.dmp

          Filesize

          7.1MB

        • memory/2420-27-0x00007FFD4A380000-0x00007FFD4AE41000-memory.dmp

          Filesize

          10.8MB

        • memory/2420-4-0x00007FFD4A380000-0x00007FFD4AE41000-memory.dmp

          Filesize

          10.8MB

        • memory/2568-112-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/2568-114-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/2568-110-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/2568-115-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3116-67-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3116-70-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3116-72-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3116-73-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3116-74-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3288-116-0x0000000140000000-0x0000000140057000-memory.dmp

          Filesize

          348KB

        • memory/3288-118-0x0000000140000000-0x0000000140057000-memory.dmp

          Filesize

          348KB

        • memory/3288-119-0x0000000140000000-0x0000000140057000-memory.dmp

          Filesize

          348KB

        • memory/3288-120-0x0000000140000000-0x0000000140057000-memory.dmp

          Filesize

          348KB

        • memory/3504-63-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3504-58-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3504-61-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3504-62-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3504-60-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/3588-133-0x0000000140000000-0x000000014003E000-memory.dmp

          Filesize

          248KB

        • memory/3588-132-0x0000000140000000-0x000000014003E000-memory.dmp

          Filesize

          248KB

        • memory/4416-107-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4416-106-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4416-104-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4576-94-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4576-91-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4576-93-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4724-36-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4724-37-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4724-34-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4724-35-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4724-32-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4724-30-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4800-125-0x0000000140000000-0x0000000140057000-memory.dmp

          Filesize

          348KB

        • memory/4800-126-0x0000000140000000-0x0000000140057000-memory.dmp

          Filesize

          348KB

        • memory/4944-97-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4944-99-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4944-101-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/4952-43-0x000000001B640000-0x000000001B650000-memory.dmp

          Filesize

          64KB

        • memory/4952-64-0x00007FFD4A380000-0x00007FFD4AE41000-memory.dmp

          Filesize

          10.8MB

        • memory/4952-87-0x000000001B640000-0x000000001B650000-memory.dmp

          Filesize

          64KB

        • memory/4952-14-0x0000000000810000-0x000000000082C000-memory.dmp

          Filesize

          112KB

        • memory/4952-13-0x00007FFD4A380000-0x00007FFD4AE41000-memory.dmp

          Filesize

          10.8MB

        • memory/4952-163-0x00007FFD4A380000-0x00007FFD4AE41000-memory.dmp

          Filesize

          10.8MB

        • memory/5112-88-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/5112-86-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/5112-84-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB