Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2024, 14:26

General

  • Target

    68WAntiLagApp_protected.exe

  • Size

    203KB

  • MD5

    9e814f107ec4f396add666fd5ff724cf

  • SHA1

    2fe31b58361f63f172031431bce91630a4d31b36

  • SHA256

    5f6d2b2e54fd3058a6c664c5b9763e59ffb8f9b4de5db74611f7b93178a065af

  • SHA512

    d1473359577a8c07c834ee31e95d52c749cc53200fd0df8a4e88a81cc5b19b6cc0c04c0664f3261acd10ed3346b55fdc1a45793ec36684f3b10649c26d863fd3

  • SSDEEP

    3072:p8PfBGaeVMhi5ys3UGVmaxpbJnzIs0+M2njqhYUSWw8jXbt1MJBTswdT+WLo2/J:p8n/hiws3hsaxpb8+VnQ7XbS

Malware Config

Extracted

Family

xworm

C2

region-vip.gl.at.ply.gg:52733

Attributes
  • Install_directory

    %AppData%

  • install_file

    explorer.exe

  • telegram

    https://api.telegram.org/bot6976323003:AAGzNfsdTYlBPbGEbbSm--c7mAZ9PZzt9Xw/sendMessage?chat_id=5476035148

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 49 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68WAntiLagApp_protected.exe
    "C:\Users\Admin\AppData\Local\Temp\68WAntiLagApp_protected.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'explorer';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'explorer' -Value '"C:\Users\Admin\AppData\Roaming\explorer\explorer.exe.exe"' -PropertyType 'String'
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4996
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /C schtasks /create /tn \explorer /tr "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3656
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn \explorer /tr "C:\Users\Admin\AppData\Roaming\explorer\explorer.exe.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:5044
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      #cmd
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"
        3⤵
        • Creates scheduled task(s)
        PID:4660
  • C:\Users\Admin\AppData\Roaming\explorer.exe
    C:\Users\Admin\AppData\Roaming\explorer.exe
    1⤵
    • Executes dropped EXE
    PID:968
  • C:\Users\Admin\AppData\Roaming\explorer.exe
    C:\Users\Admin\AppData\Roaming\explorer.exe
    1⤵
    • Executes dropped EXE
    PID:2456
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4560
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2152
    • C:\Users\Admin\AppData\Roaming\explorer.exe
      C:\Users\Admin\AppData\Roaming\explorer.exe
      1⤵
      • Executes dropped EXE
      PID:4508

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\explorer.exe.log

            Filesize

            42B

            MD5

            84cfdb4b995b1dbf543b26b86c863adc

            SHA1

            d2f47764908bf30036cf8248b9ff5541e2711fa2

            SHA256

            d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

            SHA512

            485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xav5so03.jlk.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk

            Filesize

            778B

            MD5

            3d1ce826bf40e13c5e77d2b8f8f44316

            SHA1

            f79cbf9e5913391236182c82e8bfcdb9b787ec18

            SHA256

            9ddc8a468e10a4d42af997f4352ae6ee826efd145ba6be186f2c20e4d916c958

            SHA512

            e610cfa7031aa7f7cfb2ebd1903d655dd93f0ec7d19726f24009a44e1e15dacc726cd42928e57cbf90a987281deb5c493d27ffc3f77a323a5caff7370985478f

          • C:\Users\Admin\AppData\Roaming\explorer.exe

            Filesize

            63KB

            MD5

            0d5df43af2916f47d00c1573797c1a13

            SHA1

            230ab5559e806574d26b4c20847c368ed55483b0

            SHA256

            c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

            SHA512

            f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

          • memory/968-67-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/968-66-0x0000000000200000-0x0000000000212000-memory.dmp

            Filesize

            72KB

          • memory/968-69-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/1064-4-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/1064-8-0x0000000005280000-0x000000000531C000-memory.dmp

            Filesize

            624KB

          • memory/1064-9-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/1064-63-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/1064-70-0x0000000005420000-0x0000000005430000-memory.dmp

            Filesize

            64KB

          • memory/1064-62-0x0000000005420000-0x0000000005430000-memory.dmp

            Filesize

            64KB

          • memory/1064-71-0x0000000007400000-0x0000000007492000-memory.dmp

            Filesize

            584KB

          • memory/1624-0-0x0000000000AC0000-0x0000000000AFA000-memory.dmp

            Filesize

            232KB

          • memory/1624-6-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/1624-2-0x0000000005970000-0x0000000005F14000-memory.dmp

            Filesize

            5.6MB

          • memory/1624-1-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/2456-75-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/2456-90-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/4508-92-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/4560-85-0x0000020EEED60000-0x0000020EEED61000-memory.dmp

            Filesize

            4KB

          • memory/4560-76-0x0000020EEED60000-0x0000020EEED61000-memory.dmp

            Filesize

            4KB

          • memory/4560-77-0x0000020EEED60000-0x0000020EEED61000-memory.dmp

            Filesize

            4KB

          • memory/4560-78-0x0000020EEED60000-0x0000020EEED61000-memory.dmp

            Filesize

            4KB

          • memory/4560-82-0x0000020EEED60000-0x0000020EEED61000-memory.dmp

            Filesize

            4KB

          • memory/4560-83-0x0000020EEED60000-0x0000020EEED61000-memory.dmp

            Filesize

            4KB

          • memory/4560-84-0x0000020EEED60000-0x0000020EEED61000-memory.dmp

            Filesize

            4KB

          • memory/4560-86-0x0000020EEED60000-0x0000020EEED61000-memory.dmp

            Filesize

            4KB

          • memory/4560-87-0x0000020EEED60000-0x0000020EEED61000-memory.dmp

            Filesize

            4KB

          • memory/4560-88-0x0000020EEED60000-0x0000020EEED61000-memory.dmp

            Filesize

            4KB

          • memory/4996-25-0x0000000005C70000-0x0000000005CD6000-memory.dmp

            Filesize

            408KB

          • memory/4996-51-0x00000000076A0000-0x00000000076B4000-memory.dmp

            Filesize

            80KB

          • memory/4996-52-0x00000000077A0000-0x00000000077BA000-memory.dmp

            Filesize

            104KB

          • memory/4996-53-0x0000000007780000-0x0000000007788000-memory.dmp

            Filesize

            32KB

          • memory/4996-54-0x00000000077C0000-0x00000000077E2000-memory.dmp

            Filesize

            136KB

          • memory/4996-57-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/4996-50-0x0000000007690000-0x000000000769E000-memory.dmp

            Filesize

            56KB

          • memory/4996-49-0x0000000007660000-0x0000000007671000-memory.dmp

            Filesize

            68KB

          • memory/4996-48-0x00000000076E0000-0x0000000007776000-memory.dmp

            Filesize

            600KB

          • memory/4996-47-0x00000000074E0000-0x00000000074EA000-memory.dmp

            Filesize

            40KB

          • memory/4996-46-0x0000000007460000-0x000000000747A000-memory.dmp

            Filesize

            104KB

          • memory/4996-45-0x0000000007AB0000-0x000000000812A000-memory.dmp

            Filesize

            6.5MB

          • memory/4996-44-0x0000000007330000-0x00000000073D3000-memory.dmp

            Filesize

            652KB

          • memory/4996-43-0x0000000004B70000-0x0000000004B80000-memory.dmp

            Filesize

            64KB

          • memory/4996-42-0x0000000004B70000-0x0000000004B80000-memory.dmp

            Filesize

            64KB

          • memory/4996-41-0x0000000006750000-0x000000000676E000-memory.dmp

            Filesize

            120KB

          • memory/4996-31-0x0000000072D90000-0x0000000072DDC000-memory.dmp

            Filesize

            304KB

          • memory/4996-30-0x0000000006710000-0x0000000006742000-memory.dmp

            Filesize

            200KB

          • memory/4996-29-0x000000007F740000-0x000000007F750000-memory.dmp

            Filesize

            64KB

          • memory/4996-28-0x0000000006170000-0x00000000061BC000-memory.dmp

            Filesize

            304KB

          • memory/4996-27-0x0000000006140000-0x000000000615E000-memory.dmp

            Filesize

            120KB

          • memory/4996-26-0x0000000005CE0000-0x0000000006034000-memory.dmp

            Filesize

            3.3MB

          • memory/4996-15-0x0000000005A90000-0x0000000005AF6000-memory.dmp

            Filesize

            408KB

          • memory/4996-14-0x0000000004B70000-0x0000000004B80000-memory.dmp

            Filesize

            64KB

          • memory/4996-12-0x00000000051A0000-0x00000000051C2000-memory.dmp

            Filesize

            136KB

          • memory/4996-13-0x0000000004B70000-0x0000000004B80000-memory.dmp

            Filesize

            64KB

          • memory/4996-11-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/4996-10-0x00000000051F0000-0x0000000005818000-memory.dmp

            Filesize

            6.2MB

          • memory/4996-7-0x0000000004B80000-0x0000000004BB6000-memory.dmp

            Filesize

            216KB