Analysis

  • max time kernel
    151s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2024, 13:12

General

  • Target

    b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe

  • Size

    7.0MB

  • MD5

    6b47add2cf208a988c57c8f00461de0b

  • SHA1

    cf9518f4bd3cf94ab7225423e4365f4a262a9c61

  • SHA256

    b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07

  • SHA512

    e2f5eb2e82ab1951e0bfe0994219ed676a71ccb9804be7ebbea42d9ad9596922c16600a101caccbbfd161b98fcc2d7b3e9591afb66e1878627f6cee0918b6a35

  • SSDEEP

    196608:oA+bmZgkjTKD4C4+e4YcJE4AcnPmP99j+zE/k:oAEGZjTvC4EtAcPmPJ/

Malware Config

Extracted

Family

xworm

C2

210.246.215.82:7000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    WindowsNT.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 19 IoCs
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe
    "C:\Users\Admin\AppData\Local\Temp\b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      "C:\Users\Admin\AppData\Roaming\XClient.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3912
    • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
      "C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4344
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblAuthManager
        3⤵
        • Executes dropped EXE
        PID:3808
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblGameSave
        3⤵
        • Executes dropped EXE
        PID:2984
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxGipSvc
        3⤵
        • Executes dropped EXE
        PID:2636
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxNetApiSvc
        3⤵
        • Executes dropped EXE
        PID:404
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop xboxgip
        3⤵
        • Executes dropped EXE
        PID:4152
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblAuthManager
        3⤵
        • Executes dropped EXE
        PID:4468
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblGameSave
        3⤵
        • Executes dropped EXE
        PID:4304
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XboxNetApiSvc
        3⤵
        • Executes dropped EXE
        PID:4460
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XboxGipSvc
        3⤵
        • Executes dropped EXE
        PID:32
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete xboxgip
        3⤵
        • Executes dropped EXE
        PID:832
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop vgk
        3⤵
        • Executes dropped EXE
        PID:4056
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\xbgm" /f
        3⤵
        • Executes dropped EXE
        PID:412
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f
        3⤵
        • Executes dropped EXE
        PID:3916
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /disable
        3⤵
        • Executes dropped EXE
        PID:2224
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe /Change /TN "Microsoft\XblGameSave\XblGameSaveTaskLogon" /disableL
        3⤵
        • Executes dropped EXE
        PID:3620
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe -Command "& {Get-AppxPackage -allusers *xbox* | Remove-AppxPackage}"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1496
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:3952
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1792 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:5004
    • C:\Windows\System32\mousocoreworker.exe
      C:\Windows\System32\mousocoreworker.exe -Embedding
      1⤵
        PID:2224

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mjrlycm0.i4x.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Roaming\XClient.exe

              Filesize

              87KB

              MD5

              626eb43e3611e3217f8602f7b8206889

              SHA1

              358935565a0a495a62559b204b7b41cbc365d8d9

              SHA256

              3c468ad439464cebe619052e06cf797b296ab0d9bcf88d475fb5c9b42b489573

              SHA512

              f4bf30eeadb557501362de71d4b6d58ab498d98e52b453f6e20309da36fe288d098dab9bb08cfcecf12787536ff20f0e649401ab6b0ff75e6671a4f3ebc4cd29

            • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe

              Filesize

              6.8MB

              MD5

              233320478ce264f9e08d249244dc4fdb

              SHA1

              af46758a7c39b4edf4b5b0819f732abb5ad19e17

              SHA256

              edb57df920f62e6f1241695f8a46e420f104455a54fe91431db545834fd8d5ba

              SHA512

              b1c06e96cbabd58f8489a18c8c270718cea634a9bbd4fd67786cd5d31cfa475d4f97e2389f1ce2b5ddf10db9687b5cb5361e878d29427f9670f59343468d5967

            • memory/32-99-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/32-101-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/32-102-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/32-103-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/404-62-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/404-65-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/404-61-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/404-59-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/404-63-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/412-124-0x0000000140000000-0x0000000140057000-memory.dmp

              Filesize

              348KB

            • memory/412-119-0x0000000140000000-0x0000000140057000-memory.dmp

              Filesize

              348KB

            • memory/412-122-0x0000000140000000-0x0000000140057000-memory.dmp

              Filesize

              348KB

            • memory/412-123-0x0000000140000000-0x0000000140057000-memory.dmp

              Filesize

              348KB

            • memory/412-125-0x0000000140000000-0x0000000140057000-memory.dmp

              Filesize

              348KB

            • memory/832-106-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/832-108-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/832-110-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/1496-167-0x000001A06BBD0000-0x000001A06BBF6000-memory.dmp

              Filesize

              152KB

            • memory/1496-164-0x000001A0696E0000-0x000001A0696F0000-memory.dmp

              Filesize

              64KB

            • memory/1496-177-0x00007FFCA2550000-0x00007FFCA3011000-memory.dmp

              Filesize

              10.8MB

            • memory/1496-151-0x0000000140000000-0x0000000140071000-memory.dmp

              Filesize

              452KB

            • memory/1496-161-0x00007FFCA2550000-0x00007FFCA3011000-memory.dmp

              Filesize

              10.8MB

            • memory/1496-162-0x000001A0514A0000-0x000001A0514C2000-memory.dmp

              Filesize

              136KB

            • memory/1496-163-0x000001A0696E0000-0x000001A0696F0000-memory.dmp

              Filesize

              64KB

            • memory/1496-176-0x0000000140000000-0x0000000140071000-memory.dmp

              Filesize

              452KB

            • memory/1496-165-0x000001A069660000-0x000001A069676000-memory.dmp

              Filesize

              88KB

            • memory/1496-166-0x000001A0514F0000-0x000001A0514FA000-memory.dmp

              Filesize

              40KB

            • memory/1496-168-0x000001A0696E0000-0x000001A0696F0000-memory.dmp

              Filesize

              64KB

            • memory/1496-170-0x00007FFCA2550000-0x00007FFCA3011000-memory.dmp

              Filesize

              10.8MB

            • memory/1496-172-0x000001A0696E0000-0x000001A0696F0000-memory.dmp

              Filesize

              64KB

            • memory/2224-136-0x0000000140000000-0x000000014003E000-memory.dmp

              Filesize

              248KB

            • memory/2224-137-0x0000000140000000-0x000000014003E000-memory.dmp

              Filesize

              248KB

            • memory/2636-54-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/2636-56-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/2636-50-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/2636-52-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/2636-55-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/2984-41-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/2984-44-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/2984-43-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/2984-46-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/2984-47-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/3620-143-0x0000000140000000-0x000000014003E000-memory.dmp

              Filesize

              248KB

            • memory/3808-32-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/3808-30-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/3808-34-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/3808-36-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/3808-35-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/3808-37-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/3808-38-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/3912-64-0x00007FFCA2550000-0x00007FFCA3011000-memory.dmp

              Filesize

              10.8MB

            • memory/3912-13-0x00007FFCA2550000-0x00007FFCA3011000-memory.dmp

              Filesize

              10.8MB

            • memory/3912-76-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

              Filesize

              64KB

            • memory/3912-109-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

              Filesize

              64KB

            • memory/3912-14-0x00000000003A0000-0x00000000003BC000-memory.dmp

              Filesize

              112KB

            • memory/3912-173-0x00007FFCA2550000-0x00007FFCA3011000-memory.dmp

              Filesize

              10.8MB

            • memory/3916-130-0x0000000140000000-0x0000000140057000-memory.dmp

              Filesize

              348KB

            • memory/3952-203-0x0000021150D40000-0x0000021150D41000-memory.dmp

              Filesize

              4KB

            • memory/3952-201-0x0000000140000000-0x0000000140AE7000-memory.dmp

              Filesize

              10.9MB

            • memory/3952-183-0x0000000140000000-0x0000000140AE7000-memory.dmp

              Filesize

              10.9MB

            • memory/3952-207-0x0000000140000000-0x0000000140AE7000-memory.dmp

              Filesize

              10.9MB

            • memory/3952-206-0x0000000140000000-0x0000000140AE7000-memory.dmp

              Filesize

              10.9MB

            • memory/4056-118-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4056-117-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4056-116-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4056-115-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4056-113-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4152-68-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4152-75-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4152-74-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4152-71-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4152-72-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4304-89-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4304-85-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4304-87-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4344-29-0x00007FFCC1390000-0x00007FFCC1585000-memory.dmp

              Filesize

              2.0MB

            • memory/4344-121-0x00007FF714D80000-0x00007FF715870000-memory.dmp

              Filesize

              10.9MB

            • memory/4344-69-0x00007FF714D80000-0x00007FF715870000-memory.dmp

              Filesize

              10.9MB

            • memory/4344-27-0x00007FF714D80000-0x00007FF715870000-memory.dmp

              Filesize

              10.9MB

            • memory/4344-73-0x00007FFCC1390000-0x00007FFCC1585000-memory.dmp

              Filesize

              2.0MB

            • memory/4424-0-0x0000000000420000-0x0000000000B2E000-memory.dmp

              Filesize

              7.1MB

            • memory/4424-4-0x00007FFCA2550000-0x00007FFCA3011000-memory.dmp

              Filesize

              10.8MB

            • memory/4424-26-0x00007FFCA2550000-0x00007FFCA3011000-memory.dmp

              Filesize

              10.8MB

            • memory/4460-92-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4460-94-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4460-96-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4468-81-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4468-82-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB

            • memory/4468-79-0x0000000140000000-0x0000000140017000-memory.dmp

              Filesize

              92KB