Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2024, 13:34

General

  • Target

    b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe

  • Size

    7.0MB

  • MD5

    6b47add2cf208a988c57c8f00461de0b

  • SHA1

    cf9518f4bd3cf94ab7225423e4365f4a262a9c61

  • SHA256

    b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07

  • SHA512

    e2f5eb2e82ab1951e0bfe0994219ed676a71ccb9804be7ebbea42d9ad9596922c16600a101caccbbfd161b98fcc2d7b3e9591afb66e1878627f6cee0918b6a35

  • SSDEEP

    196608:oA+bmZgkjTKD4C4+e4YcJE4AcnPmP99j+zE/k:oAEGZjTvC4EtAcPmPJ/

Malware Config

Extracted

Family

xworm

C2

210.246.215.82:7000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    WindowsNT.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 19 IoCs
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe
    "C:\Users\Admin\AppData\Local\Temp\b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      "C:\Users\Admin\AppData\Roaming\XClient.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
      "C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblAuthManager
        3⤵
        • Executes dropped EXE
        PID:3816
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblGameSave
        3⤵
        • Executes dropped EXE
        PID:5024
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxGipSvc
        3⤵
        • Executes dropped EXE
        PID:3332
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxNetApiSvc
        3⤵
        • Executes dropped EXE
        PID:2112
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop xboxgip
        3⤵
        • Executes dropped EXE
        PID:4060
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblAuthManager
        3⤵
        • Executes dropped EXE
        PID:2340
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblGameSave
        3⤵
        • Executes dropped EXE
        PID:5096
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XboxNetApiSvc
        3⤵
        • Executes dropped EXE
        PID:3260
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XboxGipSvc
        3⤵
        • Executes dropped EXE
        PID:3032
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete xboxgip
        3⤵
        • Executes dropped EXE
        PID:1180
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop vgk
        3⤵
        • Executes dropped EXE
        PID:1452
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\xbgm" /f
        3⤵
        • Executes dropped EXE
        PID:4392
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f
        3⤵
        • Executes dropped EXE
        PID:4572
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /disable
        3⤵
        • Executes dropped EXE
        PID:2328
      • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
        C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe /Change /TN "Microsoft\XblGameSave\XblGameSaveTaskLogon" /disableL
        3⤵
        • Executes dropped EXE
        PID:1652
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          4⤵
            PID:3816
        • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
          C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe -Command "& {Get-AppxPackage -allusers *xbox* | Remove-AppxPackage}"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4956
        • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
          C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:2148

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pabk3s1r.fn4.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Roaming\XClient.exe

            Filesize

            87KB

            MD5

            626eb43e3611e3217f8602f7b8206889

            SHA1

            358935565a0a495a62559b204b7b41cbc365d8d9

            SHA256

            3c468ad439464cebe619052e06cf797b296ab0d9bcf88d475fb5c9b42b489573

            SHA512

            f4bf30eeadb557501362de71d4b6d58ab498d98e52b453f6e20309da36fe288d098dab9bb08cfcecf12787536ff20f0e649401ab6b0ff75e6671a4f3ebc4cd29

          • C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe

            Filesize

            6.8MB

            MD5

            233320478ce264f9e08d249244dc4fdb

            SHA1

            af46758a7c39b4edf4b5b0819f732abb5ad19e17

            SHA256

            edb57df920f62e6f1241695f8a46e420f104455a54fe91431db545834fd8d5ba

            SHA512

            b1c06e96cbabd58f8489a18c8c270718cea634a9bbd4fd67786cd5d31cfa475d4f97e2389f1ce2b5ddf10db9687b5cb5361e878d29427f9670f59343468d5967

          • memory/1180-108-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/1180-107-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/1180-106-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/1180-104-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/1452-115-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/1452-116-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/1452-112-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/1452-114-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/1488-65-0x00007FFA53780000-0x00007FFA54241000-memory.dmp

            Filesize

            10.8MB

          • memory/1488-83-0x000000001B680000-0x000000001B690000-memory.dmp

            Filesize

            64KB

          • memory/1488-109-0x00007FFA53780000-0x00007FFA54241000-memory.dmp

            Filesize

            10.8MB

          • memory/1488-14-0x00007FFA53780000-0x00007FFA54241000-memory.dmp

            Filesize

            10.8MB

          • memory/1488-13-0x0000000000A30000-0x0000000000A4C000-memory.dmp

            Filesize

            112KB

          • memory/1652-139-0x0000000140000000-0x000000014003E000-memory.dmp

            Filesize

            248KB

          • memory/1652-197-0x0000000140000000-0x000000014003E000-memory.dmp

            Filesize

            248KB

          • memory/2112-63-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/2112-59-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/2112-62-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/2112-64-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/2112-61-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/2148-179-0x0000000140000000-0x0000000140AE7000-memory.dmp

            Filesize

            10.9MB

          • memory/2148-196-0x0000000140000000-0x0000000140AE7000-memory.dmp

            Filesize

            10.9MB

          • memory/2148-202-0x0000000140000000-0x0000000140AE7000-memory.dmp

            Filesize

            10.9MB

          • memory/2148-201-0x0000000140000000-0x0000000140AE7000-memory.dmp

            Filesize

            10.9MB

          • memory/2148-198-0x00000215351D0000-0x00000215351D1000-memory.dmp

            Filesize

            4KB

          • memory/2328-133-0x0000000140000000-0x000000014003E000-memory.dmp

            Filesize

            248KB

          • memory/2328-177-0x0000000140000000-0x000000014003E000-memory.dmp

            Filesize

            248KB

          • memory/2340-80-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/2340-81-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/2340-78-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/2340-82-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3032-98-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3032-101-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3032-100-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3260-92-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3260-94-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3260-95-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3332-54-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3332-56-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3332-50-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3332-53-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3332-52-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3332-55-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3640-26-0x00007FFA53780000-0x00007FFA54241000-memory.dmp

            Filesize

            10.8MB

          • memory/3640-0-0x0000000000E10000-0x000000000151E000-memory.dmp

            Filesize

            7.1MB

          • memory/3640-1-0x00007FFA53780000-0x00007FFA54241000-memory.dmp

            Filesize

            10.8MB

          • memory/3816-36-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3816-32-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3816-38-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3816-34-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3816-37-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3816-30-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/3816-35-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/4060-73-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/4060-72-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/4060-75-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/4060-68-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/4060-71-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/4392-121-0x0000000140000000-0x0000000140057000-memory.dmp

            Filesize

            348KB

          • memory/4392-117-0x0000000140000000-0x0000000140057000-memory.dmp

            Filesize

            348KB

          • memory/4392-119-0x0000000140000000-0x0000000140057000-memory.dmp

            Filesize

            348KB

          • memory/4392-120-0x0000000140000000-0x0000000140057000-memory.dmp

            Filesize

            348KB

          • memory/4392-160-0x0000000140000000-0x0000000140057000-memory.dmp

            Filesize

            348KB

          • memory/4572-127-0x0000000140000000-0x0000000140057000-memory.dmp

            Filesize

            348KB

          • memory/4572-126-0x0000000140000000-0x0000000140057000-memory.dmp

            Filesize

            348KB

          • memory/4956-169-0x0000000140000000-0x0000000140071000-memory.dmp

            Filesize

            452KB

          • memory/4956-163-0x00000160D8B10000-0x00000160D8B1A000-memory.dmp

            Filesize

            40KB

          • memory/4956-170-0x00007FFA53380000-0x00007FFA53E41000-memory.dmp

            Filesize

            10.8MB

          • memory/4956-147-0x0000000140000000-0x0000000140071000-memory.dmp

            Filesize

            452KB

          • memory/4956-149-0x00007FFA53380000-0x00007FFA53E41000-memory.dmp

            Filesize

            10.8MB

          • memory/4956-159-0x00000160D7CD0000-0x00000160D7CE0000-memory.dmp

            Filesize

            64KB

          • memory/4956-161-0x00000160D7CD0000-0x00000160D7CE0000-memory.dmp

            Filesize

            64KB

          • memory/4956-166-0x00000160D7CD0000-0x00000160D7CE0000-memory.dmp

            Filesize

            64KB

          • memory/4956-148-0x00000160D8690000-0x00000160D86B2000-memory.dmp

            Filesize

            136KB

          • memory/4956-165-0x00000160D7CD0000-0x00000160D7CE0000-memory.dmp

            Filesize

            64KB

          • memory/4956-162-0x00000160D8B20000-0x00000160D8B36000-memory.dmp

            Filesize

            88KB

          • memory/4956-164-0x00000160D8BC0000-0x00000160D8BE6000-memory.dmp

            Filesize

            152KB

          • memory/5024-45-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/5024-47-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/5024-41-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/5024-43-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/5024-46-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/5092-70-0x00007FF78C820000-0x00007FF78D310000-memory.dmp

            Filesize

            10.9MB

          • memory/5092-29-0x00007FFA71930000-0x00007FFA71B25000-memory.dmp

            Filesize

            2.0MB

          • memory/5092-74-0x00007FFA71930000-0x00007FFA71B25000-memory.dmp

            Filesize

            2.0MB

          • memory/5092-27-0x00007FF78C820000-0x00007FF78D310000-memory.dmp

            Filesize

            10.9MB

          • memory/5096-88-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/5096-89-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB

          • memory/5096-86-0x0000000140000000-0x0000000140017000-memory.dmp

            Filesize

            92KB