Analysis

  • max time kernel
    146s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18-04-2024 01:36

General

  • Target

    87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6.exe

  • Size

    167KB

  • MD5

    d0685487fa7e474e68a40a1b1ff49b60

  • SHA1

    069285708e07814d852bbd5f39a7ffbb3c9e2d94

  • SHA256

    87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6

  • SHA512

    eda00ba1453a33024fc05316196ccd71981ba61ababb965d1c3f01251f377047b00d8b6a9b140acf335cfa9d478bb3b6dbc4aca37fe74cfecb929e965ed190a8

  • SSDEEP

    1536:216oQ/DtPFVzE95jNNKCw5VY9bG1wWQkAw6JOXHWIOGoWIFjo7xLFVGy9w04xJXX:ouxFG9Rw3Y9bGVAfOXWxrjCT4

Malware Config

Extracted

Family

xworm

C2

dentiste.ddns.net:7000

86.68.222.14:7000

51.254.53.24:7000

Attributes
  • Install_directory

    %AppData%

  • install_file

    Mise à jour carte CPS.exe

  • telegram

    https://api.telegram.org/bot5720516014:AAF4KOAv3GXHFU0RS3g4HPsucKDwQf01__A

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects executables using Telegram Chat Bot 1 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6.exe
    "C:\Users\Admin\AppData\Local\Temp\87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3036
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2604
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Mise à jour carte CPS.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Mise à jour carte CPS.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2360
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Mise à jour carte CPS" /tr "C:\Users\Admin\AppData\Roaming\Mise à jour carte CPS.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2560
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {C86A1B4E-04DB-4EF4-A1E7-330C0FD20D2F} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
    1⤵
      PID:384

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Scheduled Task/Job

    1
    T1053

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Query Registry

    1
    T1012

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
      Filesize

      7KB

      MD5

      9bbb9c3a985a9dfe84a8c247500df6cb

      SHA1

      1ac3ae106a5b7f84fae6a93d1c98cecb291f8850

      SHA256

      44c87075f10bf00f403006fe363475e2f02289ee9c0b0f9ca2621faf13aa38f1

      SHA512

      da87d2fa1d20baecb41cf7ea215c966c47f361caf309b6960d910570d53d2f3a50188cf31fa19247b780ee614ae94a58aaff70c0c97b68ddb4581ad8a29ab9f2

    • \??\PIPE\srvsvc
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • memory/2360-49-0x0000000002D10000-0x0000000002D90000-memory.dmp
      Filesize

      512KB

    • memory/2360-47-0x0000000002D10000-0x0000000002D90000-memory.dmp
      Filesize

      512KB

    • memory/2360-53-0x000007FEEDF10000-0x000007FEEE8AD000-memory.dmp
      Filesize

      9.6MB

    • memory/2360-48-0x000007FEEDF10000-0x000007FEEE8AD000-memory.dmp
      Filesize

      9.6MB

    • memory/2360-46-0x000007FEEDF10000-0x000007FEEE8AD000-memory.dmp
      Filesize

      9.6MB

    • memory/2360-50-0x0000000002D10000-0x0000000002D90000-memory.dmp
      Filesize

      512KB

    • memory/2360-51-0x0000000002D10000-0x0000000002D90000-memory.dmp
      Filesize

      512KB

    • memory/2400-52-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp
      Filesize

      9.9MB

    • memory/2400-0-0x00000000013A0000-0x00000000013D0000-memory.dmp
      Filesize

      192KB

    • memory/2400-58-0x000000001ACC0000-0x000000001AD40000-memory.dmp
      Filesize

      512KB

    • memory/2400-59-0x000000001ACC0000-0x000000001AD40000-memory.dmp
      Filesize

      512KB

    • memory/2400-1-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp
      Filesize

      9.9MB

    • memory/2604-20-0x000000001B500000-0x000000001B7E2000-memory.dmp
      Filesize

      2.9MB

    • memory/2604-22-0x000007FEEDF10000-0x000007FEEE8AD000-memory.dmp
      Filesize

      9.6MB

    • memory/2604-21-0x00000000027A0000-0x00000000027A8000-memory.dmp
      Filesize

      32KB

    • memory/2604-23-0x0000000002960000-0x00000000029E0000-memory.dmp
      Filesize

      512KB

    • memory/2604-24-0x000007FEEDF10000-0x000007FEEE8AD000-memory.dmp
      Filesize

      9.6MB

    • memory/2604-25-0x0000000002960000-0x00000000029E0000-memory.dmp
      Filesize

      512KB

    • memory/2604-27-0x000007FEEDF10000-0x000007FEEE8AD000-memory.dmp
      Filesize

      9.6MB

    • memory/2604-26-0x0000000002960000-0x00000000029E0000-memory.dmp
      Filesize

      512KB

    • memory/2708-40-0x000007FEF1A80000-0x000007FEF241D000-memory.dmp
      Filesize

      9.6MB

    • memory/2708-36-0x000007FEF1A80000-0x000007FEF241D000-memory.dmp
      Filesize

      9.6MB

    • memory/2708-39-0x0000000002D50000-0x0000000002DD0000-memory.dmp
      Filesize

      512KB

    • memory/2708-38-0x0000000002D50000-0x0000000002DD0000-memory.dmp
      Filesize

      512KB

    • memory/2708-37-0x0000000002D50000-0x0000000002DD0000-memory.dmp
      Filesize

      512KB

    • memory/2708-35-0x0000000002D50000-0x0000000002DD0000-memory.dmp
      Filesize

      512KB

    • memory/2708-34-0x000007FEF1A80000-0x000007FEF241D000-memory.dmp
      Filesize

      9.6MB

    • memory/3036-14-0x000007FEF1A80000-0x000007FEF241D000-memory.dmp
      Filesize

      9.6MB

    • memory/3036-12-0x0000000002830000-0x00000000028B0000-memory.dmp
      Filesize

      512KB

    • memory/3036-13-0x0000000002830000-0x00000000028B0000-memory.dmp
      Filesize

      512KB

    • memory/3036-11-0x0000000002830000-0x00000000028B0000-memory.dmp
      Filesize

      512KB

    • memory/3036-10-0x000007FEF1A80000-0x000007FEF241D000-memory.dmp
      Filesize

      9.6MB

    • memory/3036-9-0x0000000002830000-0x00000000028B0000-memory.dmp
      Filesize

      512KB

    • memory/3036-7-0x000007FEF1A80000-0x000007FEF241D000-memory.dmp
      Filesize

      9.6MB

    • memory/3036-8-0x0000000002810000-0x0000000002818000-memory.dmp
      Filesize

      32KB

    • memory/3036-6-0x000000001B6B0000-0x000000001B992000-memory.dmp
      Filesize

      2.9MB