Resubmissions

08-04-2024 14:10

240408-rg3c3sba45 10

08-04-2024 14:07

240408-re6bysah74 10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08-04-2024 14:10

General

  • Target

    XWorm-V5.0/XWormLoader.exe

  • Size

    111KB

  • MD5

    9158e38c3bacd6cc50e4355783fead8b

  • SHA1

    c30c982c2d061e4bd8b5e0e3f89693b3939a0833

  • SHA256

    1f10356e86d377e76ab31ca4401f0f49f4caa9587227c61c56f8fc38dc4d7bda

  • SHA512

    98683f6d5954238428b83df22acef64b7b3ca12b84c6b7cdd90063e4800006d3243b678eb5702045c32e8a7fd76c44cd453d6b6aca732b5a4d50d555d1b753bd

  • SSDEEP

    1536:SrHEKSUVTbZgAfQFj9136yOsvSqmyVttdGFQeOPig09:SrFXgkQFj91/OsvSqmyBez9

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

testarosa.duckdns.org:7110

Mutex

Rg1w8TcZ1AXGhMnB

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    WindowsDefender.exe

aes.plain

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\XWorm-V5.0\XWormLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\XWorm-V5.0\XWormLoader.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm-V5.0\XWormLoader.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2640
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormLoader.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2296
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsDefender.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsDefender.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2520
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsDefender" /tr "C:\ProgramData\WindowsDefender.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2196
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {BD6902AD-4608-4D06-A19A-852B0348D0E8} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\ProgramData\WindowsDefender.exe
      C:\ProgramData\WindowsDefender.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:640
    • C:\ProgramData\WindowsDefender.exe
      C:\ProgramData\WindowsDefender.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\WindowsDefender.exe

    Filesize

    111KB

    MD5

    9158e38c3bacd6cc50e4355783fead8b

    SHA1

    c30c982c2d061e4bd8b5e0e3f89693b3939a0833

    SHA256

    1f10356e86d377e76ab31ca4401f0f49f4caa9587227c61c56f8fc38dc4d7bda

    SHA512

    98683f6d5954238428b83df22acef64b7b3ca12b84c6b7cdd90063e4800006d3243b678eb5702045c32e8a7fd76c44cd453d6b6aca732b5a4d50d555d1b753bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    3ca53a35d2f22c702929cb34faed088f

    SHA1

    dd5a78609e4a041a8a39ac55d4d989ab2100fa7e

    SHA256

    9d89d0650f7e298b8dd164b9507fa89de6cd56f48aa3104a455f5e095108577c

    SHA512

    38eb17def6f7f6de082c6c87a391439023f8c3c2cebafc9fd6a4033ba2216616fa3564c0e380c61d5a3ae7324de9cc2c518b89a5e7d80c96b1f29fdc708ea730

  • memory/452-64-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

    Filesize

    9.9MB

  • memory/452-63-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

    Filesize

    9.9MB

  • memory/452-62-0x00000000011A0000-0x00000000011C2000-memory.dmp

    Filesize

    136KB

  • memory/640-59-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

    Filesize

    9.9MB

  • memory/640-60-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

    Filesize

    9.9MB

  • memory/2020-0-0x0000000000170000-0x0000000000192000-memory.dmp

    Filesize

    136KB

  • memory/2020-1-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

    Filesize

    9.9MB

  • memory/2020-52-0x000000001B280000-0x000000001B300000-memory.dmp

    Filesize

    512KB

  • memory/2020-2-0x000000001B280000-0x000000001B300000-memory.dmp

    Filesize

    512KB

  • memory/2020-38-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

    Filesize

    9.9MB

  • memory/2296-23-0x000007FEED910000-0x000007FEEE2AD000-memory.dmp

    Filesize

    9.6MB

  • memory/2296-21-0x000000001B510000-0x000000001B7F2000-memory.dmp

    Filesize

    2.9MB

  • memory/2296-29-0x000007FEED910000-0x000007FEEE2AD000-memory.dmp

    Filesize

    9.6MB

  • memory/2296-22-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

    Filesize

    32KB

  • memory/2296-24-0x0000000002C20000-0x0000000002CA0000-memory.dmp

    Filesize

    512KB

  • memory/2296-25-0x000007FEED910000-0x000007FEEE2AD000-memory.dmp

    Filesize

    9.6MB

  • memory/2296-27-0x0000000002C20000-0x0000000002CA0000-memory.dmp

    Filesize

    512KB

  • memory/2296-26-0x0000000002C20000-0x0000000002CA0000-memory.dmp

    Filesize

    512KB

  • memory/2296-28-0x0000000002C20000-0x0000000002CA0000-memory.dmp

    Filesize

    512KB

  • memory/2520-48-0x0000000002ED0000-0x0000000002F50000-memory.dmp

    Filesize

    512KB

  • memory/2520-47-0x000007FEED910000-0x000007FEEE2AD000-memory.dmp

    Filesize

    9.6MB

  • memory/2520-54-0x000007FEED910000-0x000007FEEE2AD000-memory.dmp

    Filesize

    9.6MB

  • memory/2520-53-0x0000000002ED0000-0x0000000002F50000-memory.dmp

    Filesize

    512KB

  • memory/2520-51-0x0000000002ED0000-0x0000000002F50000-memory.dmp

    Filesize

    512KB

  • memory/2520-50-0x0000000002ED0000-0x0000000002F50000-memory.dmp

    Filesize

    512KB

  • memory/2520-49-0x000007FEED910000-0x000007FEEE2AD000-memory.dmp

    Filesize

    9.6MB

  • memory/2552-40-0x0000000001DC0000-0x0000000001E40000-memory.dmp

    Filesize

    512KB

  • memory/2552-37-0x000007FEEE2B0000-0x000007FEEEC4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2552-36-0x0000000001DC0000-0x0000000001E40000-memory.dmp

    Filesize

    512KB

  • memory/2552-35-0x000007FEEE2B0000-0x000007FEEEC4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2552-39-0x0000000001DC0000-0x0000000001E40000-memory.dmp

    Filesize

    512KB

  • memory/2552-41-0x000007FEEE2B0000-0x000007FEEEC4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2640-13-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2640-15-0x000007FEEE2B0000-0x000007FEEEC4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2640-14-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2640-12-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2640-11-0x000007FEEE2B0000-0x000007FEEEC4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2640-10-0x0000000002A00000-0x0000000002A80000-memory.dmp

    Filesize

    512KB

  • memory/2640-9-0x000007FEEE2B0000-0x000007FEEEC4D000-memory.dmp

    Filesize

    9.6MB

  • memory/2640-8-0x0000000002250000-0x0000000002258000-memory.dmp

    Filesize

    32KB

  • memory/2640-7-0x000000001B730000-0x000000001BA12000-memory.dmp

    Filesize

    2.9MB