Analysis
- max time kernel
133s - max time network
151s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
03/04/2024, 04:10
General
- Target yes.exe
- Size 81KB
- Sample240403-erqe2sff7t
- SHA256 d2576bc16040874601b4371730e07206214ef2e68c65963aacd90a37502ee75c
Malware Config
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\yes.exe"C:\Users\Admin\AppData\Local\Temp\yes.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegAsm.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_b5sf4dte.wu4.ps1
memory/1848-38-0x000000006F460000-0x000000006F4AB000-memory.dmp
memory/1848-20-0x00000000081C0000-0x0000000008236000-memory.dmp
memory/1848-45-0x0000000006B10000-0x0000000006B20000-memory.dmp
memory/1848-260-0x0000000073860000-0x0000000073F4E000-memory.dmp
memory/1848-12-0x0000000006B10000-0x0000000006B20000-memory.dmp
memory/1848-11-0x0000000073860000-0x0000000073F4E000-memory.dmp
memory/1848-10-0x0000000006A40000-0x0000000006A76000-memory.dmp
memory/1848-13-0x0000000007150000-0x0000000007778000-memory.dmp
memory/1848-14-0x00000000070D0000-0x00000000070F2000-memory.dmp
memory/1848-16-0x0000000007A10000-0x0000000007A76000-memory.dmp
memory/1848-15-0x0000000007830000-0x0000000007896000-memory.dmp
memory/1848-17-0x0000000007AA0000-0x0000000007DF0000-memory.dmp
memory/1848-18-0x0000000007DF0000-0x0000000007E0C000-memory.dmp
memory/1848-19-0x0000000007F60000-0x0000000007FAB000-memory.dmp
memory/1848-44-0x0000000009420000-0x00000000094C5000-memory.dmp
memory/1848-244-0x0000000009570000-0x0000000009578000-memory.dmp
memory/1848-39-0x00000000090B0000-0x00000000090CE000-memory.dmp
memory/1848-239-0x00000000095A0000-0x00000000095BA000-memory.dmp
memory/1848-46-0x0000000009640000-0x00000000096D4000-memory.dmp
memory/1848-37-0x00000000090F0000-0x0000000009123000-memory.dmp
memory/2624-503-0x0000000006100000-0x000000000610A000-memory.dmp
memory/2624-501-0x0000000005B50000-0x000000000604E000-memory.dmp
memory/2624-507-0x0000000000430000-0x0000000000440000-memory.dmp
memory/2624-3-0x0000000000400000-0x0000000000418000-memory.dmp
memory/2624-7-0x0000000073860000-0x0000000073F4E000-memory.dmp
memory/2624-6-0x0000000004960000-0x00000000049FC000-memory.dmp
memory/2624-506-0x0000000000430000-0x0000000000440000-memory.dmp
memory/2624-505-0x0000000002120000-0x000000000212C000-memory.dmp
memory/2624-504-0x0000000073860000-0x0000000073F4E000-memory.dmp
memory/2624-502-0x0000000006050000-0x00000000060E2000-memory.dmp
memory/4024-500-0x0000000073860000-0x0000000073F4E000-memory.dmp
memory/4024-284-0x000000006F460000-0x000000006F4AB000-memory.dmp
memory/4024-266-0x0000000004280000-0x0000000004290000-memory.dmp
memory/4024-289-0x0000000004280000-0x0000000004290000-memory.dmp
memory/4024-264-0x0000000073860000-0x0000000073F4E000-memory.dmp
memory/4024-265-0x0000000004280000-0x0000000004290000-memory.dmp
memory/4044-1-0x0000000073860000-0x0000000073F4E000-memory.dmp
memory/4044-5-0x0000000073860000-0x0000000073F4E000-memory.dmp
memory/4044-2-0x00000000059B0000-0x00000000059C0000-memory.dmp
memory/4044-0-0x0000000000FD0000-0x0000000000FEA000-memory.dmp