Resubmissions
09/04/2024, 08:32
240409-kfg77aaf851009/04/2024, 08:32
240409-kfglnaaf841009/04/2024, 08:32
240409-kffz5aea2y1009/04/2024, 08:32
240409-kffpcsaf791011/03/2024, 08:03
240311-jxm94afe6y1010/03/2024, 15:15
240310-snee9sfd3y10Analysis
- max time kernel
600s - max time network
592s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
09/04/2024, 08:32
General
- Target FUCKER.exe
- Size 10KB
- Sample240409-kffz5aea2y
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
xworm
-
94.156.8.213:58002
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Detect ZGRat V1 34 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 9 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\amadycry.exe"C:\Users\Admin\AppData\Local\Temp\Files\amadycry.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1234.exe"C:\Users\Admin\AppData\Local\Temp\Files\1234.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Tester.exe"C:\Users\Admin\AppData\Local\Temp\Files\Tester.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe"C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1243⤵
- Loads dropped DLL
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Tinder%20Bot.exe"C:\Users\Admin\AppData\Local\Temp\Files\Tinder%20Bot.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {1C063F52-03B5-47D2-AFAB-AB4AF95D4E87} S-1-5-21-3787592910-3720486031-2929222812-1000:HSNHLVYA\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exeC:\Windows\svchost.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
LummaC2.exe
Tester.exe
Tar9C66.tmp
590aee7bdd69b59b.customDestinations-ms
1234.exe
Tinder%20Bot.exe
amadycry.exe
memory/1324-0-0x0000000000DB0000-0x0000000000DB8000-memory.dmp
memory/1324-288-0x0000000074090000-0x000000007477E000-memory.dmp
memory/1324-2-0x0000000004B50000-0x0000000004B90000-memory.dmp
memory/1324-1-0x0000000074090000-0x000000007477E000-memory.dmp
memory/1348-289-0x0000000000C70000-0x0000000000F06000-memory.dmp
memory/1348-290-0x000007FEF4CC0000-0x000007FEF56AC000-memory.dmp
memory/1348-293-0x000007FEF4CC0000-0x000007FEF56AC000-memory.dmp
memory/1568-281-0x0000000000170000-0x0000000000171000-memory.dmp
memory/1624-301-0x0000000002B14000-0x0000000002B17000-memory.dmp
memory/1624-303-0x000007FEECD10000-0x000007FEED6AD000-memory.dmp
memory/1624-299-0x000000001B450000-0x000000001B732000-memory.dmp
memory/1624-300-0x0000000001DE0000-0x0000000001DE8000-memory.dmp
memory/1624-302-0x000007FEECD10000-0x000007FEED6AD000-memory.dmp
memory/1624-304-0x0000000002B10000-0x0000000002B90000-memory.dmp
memory/1980-312-0x000007FEEC370000-0x000007FEECD0D000-memory.dmp
memory/1980-319-0x000007FEEC370000-0x000007FEECD0D000-memory.dmp
memory/1980-311-0x0000000002610000-0x0000000002618000-memory.dmp
memory/1980-310-0x000000001B100000-0x000000001B3E2000-memory.dmp
memory/1980-318-0x0000000002490000-0x0000000002510000-memory.dmp
memory/1980-313-0x0000000002490000-0x0000000002510000-memory.dmp
memory/1980-314-0x000007FEEC370000-0x000007FEECD0D000-memory.dmp
memory/1980-315-0x0000000002490000-0x0000000002510000-memory.dmp
memory/2112-326-0x000007FEF42D0000-0x000007FEF4CBC000-memory.dmp
memory/2112-327-0x0000000001040000-0x000000000108A000-memory.dmp
memory/2112-328-0x000000001AFF0000-0x000000001B070000-memory.dmp
memory/2112-329-0x00000000003E0000-0x00000000003F8000-memory.dmp
memory/2112-330-0x000007FEF42D0000-0x000007FEF4CBC000-memory.dmp
memory/2112-331-0x000000001AFF0000-0x000000001B070000-memory.dmp
memory/2336-212-0x0000000000AC0000-0x0000000000B0A000-memory.dmp
memory/2336-322-0x000007FEF4CC0000-0x000007FEF56AC000-memory.dmp
memory/2336-317-0x000007FEF4CC0000-0x000007FEF56AC000-memory.dmp
memory/2336-292-0x000000001AFE0000-0x000000001B060000-memory.dmp
memory/2336-280-0x000007FEF4CC0000-0x000007FEF56AC000-memory.dmp
memory/2804-108-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-131-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-129-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-127-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-133-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-135-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-137-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-139-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-141-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-143-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-145-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-147-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-149-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-151-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-153-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-155-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-157-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-159-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-161-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-163-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-165-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-167-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-125-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-123-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-121-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-119-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-316-0x0000000074090000-0x000000007477E000-memory.dmp
memory/2804-104-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-102-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-91-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-100-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-89-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-84-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-87-0x0000000004E90000-0x00000000050D8000-memory.dmp
memory/2804-76-0x0000000004E90000-0x00000000050DE000-memory.dmp
memory/2804-70-0x0000000074090000-0x000000007477E000-memory.dmp
memory/2804-69-0x0000000000A40000-0x0000000000C94000-memory.dmp