Analysis
-
max time kernel
108s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
07-04-2024 07:31
General
-
Target
f267a71692c3683e3d6d0461e003f54f.exe
-
Size
2.3MB
-
MD5
f267a71692c3683e3d6d0461e003f54f
-
SHA1
189450a513d1f2412470eb965468f1324633d252
-
SHA256
74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251
-
SHA512
b376166646548104ee092beba9af8af5a04695f828e1a1b21ccdfd8a1cb88347a40f31108066d0fe6176a5ce18bf3ef3b8ce4e82a6c6a6ee886efe2bfa7a7bd7
-
SSDEEP
49152:qjOIzFMNQnXmsIi7MS4bdotKHDG/GGcYsKYX78Y5Ye3:qjvzFMNQnWspj4bdot45GdsKYXl5Yo
Malware Config
Extracted
xworm
3.1
gamemodz.duckdns.org:6969
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect HermeticWiper 1 IoCs
Detect HermeticWiper Payload.
-
Detect Xworm Payload 2 IoCs
-
Detect ZGRat V1 34 IoCs
-
HermeticWiper
HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
-
Xworm
Xworm is a remote access trojan written in C#.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Drops file in Drivers directory 42 IoCs
-
Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 9 IoCs
-
Loads dropped DLL 13 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 64 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f267a71692c3683e3d6d0461e003f54f.exe"C:\Users\Admin\AppData\Local\Temp\f267a71692c3683e3d6d0461e003f54f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\$77d8217c"C:\Users\Admin\AppData\Local\Temp\$77d8217c"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 1283⤵
- Loads dropped DLL
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\$775574fe"C:\Users\Admin\AppData\Local\Temp\$775574fe"2⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$775574fe" /tr "C:\Users\Admin\AppData\Roaming\$775574fe"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\nwoakg.exe"C:\Users\Admin\AppData\Local\Temp\nwoakg.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\93F6.tmp\93F7.tmp\93F8.vbs //Nologo4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\93F6.tmp\mbr.exe"C:\Users\Admin\AppData\Local\Temp\93F6.tmp\mbr.exe"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Users\Admin\AppData\Local\Temp\93F6.tmp\bytebeat1.exe"C:\Users\Admin\AppData\Local\Temp\93F6.tmp\bytebeat1.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\93F6.tmp\rgb.exe"C:\Users\Admin\AppData\Local\Temp\93F6.tmp\rgb.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\93F6.tmp\sinewaves.exe"C:\Users\Admin\AppData\Local\Temp\93F6.tmp\sinewaves.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\93F6.tmp\Lines.exe"C:\Users\Admin\AppData\Local\Temp\93F6.tmp\Lines.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\xihbdo.exe"C:\Users\Admin\AppData\Local\Temp\xihbdo.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {28BAE6C8-7A71-4E26-9264-633DD00E9058} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\$775574feC:\Users\Admin\AppData\Roaming\$775574fe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\$77a3d85e"C:\Users\Admin\AppData\Local\Temp\$77a3d85e"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9B
MD59d88efac0177f99fa528033afb54e378
SHA1a6fef6b2f49cdb2e476020bd1e7da65997d9bfc3
SHA256845640b68b92599fcab7a1a64ddd79087781cefcc5ed743ac4eee5c760b4ada5
SHA512ffa3236f35b7e8ed5e52c31d330aaf1bb0ee87e5e107b033a3377f593d6a02c6716332f582c175fc2f17a520db9f28036254c58b2fea74844e1e90f75628abfc
-
Filesize
3KB
MD5dbe460e73bc825119c6326250ac8f223
SHA1191f599142390b486868a952f6c3df8eedc60ab2
SHA25639ec4ede07d340f3ce319a28da8ebf3cdee86ae95241a53fa99fe729746aaef0
SHA512f363475209e743e38b32078a24f99e89c93e18e7100a4c28d49d9054e981cbcaaef6960d434464af6f37789f76065d18671609e3a1b369ced34a8b14da1b06a3
-
Filesize
103KB
MD56381e3e4b02204e1353218ee6ec45c2a
SHA1a350d4432d2a1a8c7a34d5ea7214326ffc02c270
SHA256df3cc9a807a80697cd8b72f8f17a365849146cb4e41b4340e42f78d1bc1722e1
SHA512ac7f21c539667a77236b78006740c634b7d4c0a55dcb776872bb339501112c62e1990bbb73b8f3c4e5b065167b8102fe35aa4633248b19dca602606b68b15015
-
Filesize
102KB
MD56b673ece600bcc8a665ebf251d7d926e
SHA164ef7c73a713bf3c55fb4ac4e5366a7a425f1b4e
SHA25641ac58d922f32134e75e87898d2c179d478c81edaae0d9bc28e7ce7d6f422f8b
SHA512feb18a1aa72de47fd67919e196abd200afdf22ad5a7e5dac20593252d8b2ca86982bb07c2fed3681ef06c9933c6d197590c1df65aa5df93cb6abafca5e53e9ff
-
Filesize
1.3MB
MD509d2094f56d2d38aa64eac1d90c5a554
SHA1c6268759b1eee9fdfafa0d605d62bbbf85defbca
SHA2564599f6f06c7f491a50e3c4012a83cce9f3ee13ae209189cb8964f0b6ba14614c
SHA5124ca756a06612c281ec03dd9f064b9ddaf6756b00a5d54dee62728f5cdd7ad3d928559b9857ed2f733b8b3e842b396fed94b212ef2a384265ac623433d67010f3
-
Filesize
577KB
MD5d1174d4066bc2b4c09059e7839651eac
SHA1a2b326436cb9a61ab1a9c1daa0aa6e6d424dc878
SHA2565000f70ff57cf2662d4b49c1c4ad275ac3f3d241f620988978e552c6f1c2d4fb
SHA5127ddef5b623aaa5de346cafb51a88b527d98190f7dea747b8809cfe7e7fd869dd2a202385169896c84d77db76df3d68ecfdb7d7cbdec556d071028306fe7375bd
-
Filesize
105KB
MD5bfc9e8ab494313d6efb67fc8942f5ee9
SHA11b42cc97803221538e020cb90517cb808cf19381
SHA25633cbdb6e00f3f42f58502af8a9150604a44bb9b26825c909aa0edb5c744a1f13
SHA5122d01f92397b65eade1f6140f80e2cb626b3e53b112c7e77e84ea7f6092b07c05eacb9e5e9bcb4676c8bdd10fcfba4fe297f2a01eedffffa594af87839baae030
-
Filesize
108KB
MD5e9534d452e7b06b5591e0509553f8d86
SHA12be1075e3ffe29c95fb0fcbed4dcf9fc54788a58
SHA256edce21b4ec9b68e4e8a5232c1432d5de0865f1fded27fc69965a2d3d568de909
SHA51221c40c98f9351676f9a105a733472b4b9145a2a2fe13a82b681fec1c73d893bd2be472938e2b84b70836875ed18d0e615a003b4af0f99d5d463f2031500b57c3
-
Filesize
791KB
MD5e9d46548e6009b9dd5648fce65b22511
SHA17f1aae821773d8481df3453d6ad2c6074cb55fb6
SHA256e320066f7580bb1d65f073fc673e14b5fe07021474e9254e8a78b3bb4f28e0be
SHA512bf15cee63ae05521407fc6d578daa44fd5d6f7dd876beeae01fc00906d2e949855121f81cde0042bf76a2f9bb35730606b47c5123cbf3d6ffc4a0abaf5543f44
-
Filesize
114KB
MD53f4a16b29f2f0532b7ce3e7656799125
SHA161b25d11392172e587d8da3045812a66c3385451
SHA2561bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591
SHA51232acaceda42128ef9e0a9f36ee2678d2fc296fda2df38629eb223939c8a9352b3bb2b7021bb84e9f223a4a26df57b528a711447b1451213a013fe00f9b971d80
-
Filesize
2.3MB
MD5f267a71692c3683e3d6d0461e003f54f
SHA1189450a513d1f2412470eb965468f1324633d252
SHA25674531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251
SHA512b376166646548104ee092beba9af8af5a04695f828e1a1b21ccdfd8a1cb88347a40f31108066d0fe6176a5ce18bf3ef3b8ce4e82a6c6a6ee886efe2bfa7a7bd7
-
Filesize
544KB
-
Filesize
256KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
304KB
-
Filesize
2.3MB
-
Filesize
336KB
-
Filesize
6.9MB
-
Filesize
2.4MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
2.4MB
-
Filesize
6.9MB
-
Filesize
96KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
40KB
-
Filesize
192KB
-
Filesize
864KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
864KB
-
Filesize
96KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
48KB