Resubmissions
09/04/2024, 07:01
240409-htps3scd2w1009/04/2024, 07:01
240409-htf6yacc9x1009/04/2024, 07:00
240409-hs6p7scc811009/04/2024, 07:00
240409-hss44scc7z1007/03/2024, 22:29
240307-2eh7jagg4110Analysis
- max time kernel
1799s - max time network
1798s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
09/04/2024, 07:01
General
- Target New Text Document mod.exe
- Size 8KB
- Sample240409-htps3scd2w
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Malware Config
Extracted
-
redline
-
6077866846
-
https://pastebin.com/raw/KE5Mft0T
Extracted
-
metasploit
-
metasploit_stager
-
91.92.247.21:8405
Extracted
-
xworm
-
94.156.8.213:58002
-
Install_directory
%Public%
-
install_file
svchost.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Detect ZGRat V1 32 IoCs
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Blocklisted process makes network request 3 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 23 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 9 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EcKmdzDF.exe"C:\Users\Admin\AppData\Local\Temp\EcKmdzDF.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\Temp.exe"C:\Windows\Temp\Temp.exe" -s3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exe"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exe"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u15o.0.exe"C:\Users\Admin\AppData\Local\Temp\u15o.0.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\u15o.1.exe"C:\Users\Admin\AppData\Local\Temp\u15o.1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD14⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 11523⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exe"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"2⤵
- Blocklisted process makes network request
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exe"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1500 -ip 15001⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
EcKmdzDF.exe
responsibilitylead.exe
responsiibilitylead.exe
__PSScriptPolicyTest_n1fasmil.gkj.ps1
1111.exe
1234.exe
ISetup2.exe
ISetup8.exe
MStore.exe
Props.exe
Tester.exe
crypted6077866846MVYQY.exe
disable-defender.exe
i1gcbW1E.exe
mQxBvlTA.exe
pclient.exe
svchost.exe
test2.exe
wininit.exe
xIPJVPDq.exe
ioloDMLog.txt
ioloDMLog.txt
u15o.0.exe
u15o.1.exe
memory/796-42-0x0000000000F10000-0x0000000000F32000-memory.dmp
memory/796-228-0x00000000744C0000-0x0000000074C71000-memory.dmp
memory/796-101-0x0000000006B00000-0x0000000006B4C000-memory.dmp
memory/796-131-0x0000000007540000-0x0000000007A6C000-memory.dmp
memory/796-56-0x00000000054D0000-0x0000000005536000-memory.dmp
memory/796-62-0x0000000005450000-0x0000000005460000-memory.dmp
memory/796-331-0x00000000744C0000-0x0000000074C71000-memory.dmp
memory/796-98-0x0000000006AC0000-0x0000000006AFC000-memory.dmp
memory/796-61-0x0000000005B80000-0x0000000005C8A000-memory.dmp
memory/796-143-0x00000000070B0000-0x0000000007126000-memory.dmp
memory/796-59-0x0000000005A50000-0x0000000005A62000-memory.dmp
memory/796-57-0x0000000005FE0000-0x00000000065F8000-memory.dmp
memory/796-55-0x00000000744C0000-0x0000000074C71000-memory.dmp
memory/796-119-0x0000000006E40000-0x0000000007002000-memory.dmp
memory/796-171-0x0000000007390000-0x00000000073E0000-memory.dmp
memory/796-161-0x0000000006E20000-0x0000000006E3E000-memory.dmp
memory/972-404-0x0000000000400000-0x0000000002D21000-memory.dmp
memory/972-381-0x0000000002E40000-0x0000000002F40000-memory.dmp
memory/972-383-0x0000000004A30000-0x0000000004A57000-memory.dmp
memory/976-250-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-240-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-456-0x000002CEE21F0000-0x000002CEE2200000-memory.dmp
memory/976-92-0x000002CEC7B10000-0x000002CEC7B16000-memory.dmp
memory/976-389-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp
memory/976-99-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp
memory/976-272-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-270-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-106-0x000002CEE21F0000-0x000002CEE2200000-memory.dmp
memory/976-265-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-165-0x000002CEE2300000-0x000002CEE2576000-memory.dmp
memory/976-166-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-167-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-169-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-254-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-172-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-174-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-176-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-178-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-180-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-186-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-248-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-196-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-201-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-189-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-203-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-205-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-207-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-246-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-217-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-225-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-220-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-227-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-244-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-231-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-238-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/976-234-0x000002CEE2300000-0x000002CEE2571000-memory.dmp
memory/1100-447-0x0000000000D30000-0x0000000000D7A000-memory.dmp
memory/1100-472-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp
memory/1100-454-0x000000001BA80000-0x000000001BA90000-memory.dmp
memory/1500-230-0x0000000002F70000-0x0000000003070000-memory.dmp
memory/1500-232-0x0000000004A60000-0x0000000004ACC000-memory.dmp
memory/1500-242-0x0000000000400000-0x0000000002D44000-memory.dmp
memory/1900-480-0x0000000000210000-0x0000000000218000-memory.dmp
memory/1900-481-0x00000000744C0000-0x0000000074C71000-memory.dmp
memory/1964-117-0x0000000140000000-0x0000000140004278-memory.dmp
memory/3248-163-0x0000000003FB0000-0x0000000003FB4000-memory.dmp
memory/3892-118-0x000000001BBF0000-0x000000001BC00000-memory.dmp
memory/3892-105-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp
memory/3892-1-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp
memory/3892-2-0x000000001BBF0000-0x000000001BC00000-memory.dmp
memory/3892-0-0x0000000000F80000-0x0000000000F88000-memory.dmp
memory/3908-120-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp
memory/3908-160-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp
memory/3908-130-0x000001EF7A680000-0x000001EF7A6A2000-memory.dmp
memory/3908-136-0x000001EF7A6D0000-0x000001EF7A6E0000-memory.dmp
memory/3908-121-0x000001EF7A6D0000-0x000001EF7A6E0000-memory.dmp
memory/4004-474-0x00007FFEC8710000-0x00007FFEC91D2000-memory.dmp
memory/4004-464-0x0000000000A90000-0x0000000000AA6000-memory.dmp
memory/4060-445-0x0000000000400000-0x0000000002D44000-memory.dmp
memory/4060-427-0x0000000002E40000-0x0000000002F40000-memory.dmp
memory/4236-164-0x0000000006160000-0x0000000006170000-memory.dmp
memory/4236-63-0x00000000007F0000-0x000000000190C000-memory.dmp
memory/4236-72-0x00000000007F0000-0x000000000190C000-memory.dmp
memory/4236-81-0x0000000006700000-0x0000000006CA6000-memory.dmp
memory/4236-44-0x0000000077126000-0x0000000077128000-memory.dmp
memory/4236-88-0x00000000061F0000-0x0000000006282000-memory.dmp
memory/4236-132-0x00000000007F0000-0x000000000190C000-memory.dmp
memory/4236-29-0x0000000076400000-0x00000000764F0000-memory.dmp
memory/4236-103-0x00000000036E0000-0x000000000382E000-memory.dmp
memory/4236-100-0x00000000061D0000-0x00000000061DA000-memory.dmp
memory/4236-159-0x0000000076400000-0x00000000764F0000-memory.dmp
memory/4236-24-0x0000000076400000-0x00000000764F0000-memory.dmp
memory/4236-23-0x0000000077124000-0x0000000077125000-memory.dmp
memory/4236-19-0x00000000007F0000-0x000000000190C000-memory.dmp
memory/4236-107-0x00000000061C0000-0x00000000061D4000-memory.dmp
memory/4236-133-0x0000000076400000-0x00000000764F0000-memory.dmp