Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
21/04/2024, 13:21
General
- Target SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe
- Size 87KB
- Sample240421-qlmyhscc83
- SHA256 98a9021f55ec887a271dd6b5bef911bdbf09514530db7abdb887d5282aaf7631
Malware Config
Extracted
-
xworm
-
91.92.248.52:7000
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Detect ZGRat V1 34 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe"2⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SecuriteInfo.com.Win32.RansomX-gen.10689.14408.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_32xzrzex.vh2.ps1
memory/452-5030-0x0000000004F80000-0x0000000004F90000-memory.dmp
memory/452-4898-0x0000000000400000-0x0000000000418000-memory.dmp
memory/452-4899-0x0000000004DC0000-0x0000000004E5C000-memory.dmp
memory/452-4988-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/452-4897-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/452-5031-0x0000000005F30000-0x0000000005F3A000-memory.dmp
memory/452-5032-0x0000000004F80000-0x0000000004F90000-memory.dmp
memory/868-4999-0x0000000004CC0000-0x0000000004CD0000-memory.dmp
memory/868-4974-0x0000000004CC0000-0x0000000004CD0000-memory.dmp
memory/868-4973-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/868-4975-0x0000000004CC0000-0x0000000004CD0000-memory.dmp
memory/868-4976-0x0000000005A80000-0x0000000005DD4000-memory.dmp
memory/868-4998-0x000000007FA30000-0x000000007FA40000-memory.dmp
memory/868-4987-0x0000000070070000-0x00000000700BC000-memory.dmp
memory/868-5001-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/2224-4972-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/2224-4960-0x0000000070070000-0x00000000700BC000-memory.dmp
memory/2224-4961-0x000000007F1E0000-0x000000007F1F0000-memory.dmp
memory/2224-4949-0x0000000004D10000-0x0000000004D20000-memory.dmp
memory/2224-4948-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/2840-4942-0x00000000076D0000-0x00000000076EA000-memory.dmp
memory/2840-4901-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/2840-4946-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/2840-4943-0x0000000007600000-0x0000000007608000-memory.dmp
memory/2840-4941-0x00000000075C0000-0x00000000075D4000-memory.dmp
memory/2840-4940-0x00000000075B0000-0x00000000075BE000-memory.dmp
memory/2840-4939-0x0000000007580000-0x0000000007591000-memory.dmp
memory/2840-4938-0x0000000007610000-0x00000000076A6000-memory.dmp
memory/2840-4937-0x00000000073E0000-0x00000000073EA000-memory.dmp
memory/2840-4936-0x0000000007380000-0x000000000739A000-memory.dmp
memory/2840-4935-0x00000000079C0000-0x000000000803A000-memory.dmp
memory/2840-4932-0x0000000006630000-0x000000000664E000-memory.dmp
memory/2840-4934-0x0000000007260000-0x0000000007303000-memory.dmp
memory/2840-4933-0x0000000004D10000-0x0000000004D20000-memory.dmp
memory/2840-4931-0x0000000004D10000-0x0000000004D20000-memory.dmp
memory/2840-4921-0x0000000070070000-0x00000000700BC000-memory.dmp
memory/2840-4920-0x0000000007020000-0x0000000007052000-memory.dmp
memory/2840-4919-0x000000007F790000-0x000000007F7A0000-memory.dmp
memory/2840-4918-0x00000000060A0000-0x00000000060EC000-memory.dmp
memory/2840-4917-0x0000000006050000-0x000000000606E000-memory.dmp
memory/2840-4916-0x0000000005BD0000-0x0000000005F24000-memory.dmp
memory/2840-4911-0x0000000005A60000-0x0000000005AC6000-memory.dmp
memory/2840-4905-0x0000000005980000-0x00000000059E6000-memory.dmp
memory/2840-4904-0x0000000005290000-0x00000000052B2000-memory.dmp
memory/2840-4900-0x0000000002730000-0x0000000002766000-memory.dmp
memory/2840-4902-0x0000000004D10000-0x0000000004D20000-memory.dmp
memory/2840-4903-0x0000000005350000-0x0000000005978000-memory.dmp
memory/3452-43-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-35-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-41-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-37-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-4896-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/3452-47-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-45-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-4891-0x0000000000F00000-0x0000000000F54000-memory.dmp
memory/3452-4890-0x0000000004DF0000-0x0000000004E3C000-memory.dmp
memory/3452-4889-0x0000000006240000-0x00000000062A2000-memory.dmp
memory/3452-4888-0x0000000006070000-0x0000000006071000-memory.dmp
memory/3452-2080-0x00000000053E0000-0x00000000053F0000-memory.dmp
memory/3452-1733-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/3452-69-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-67-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-65-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-63-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-61-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-59-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-57-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-55-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-53-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-1-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/3452-51-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-49-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-39-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-33-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-31-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-29-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-27-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-25-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-23-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-21-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-19-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-17-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-15-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-13-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-11-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-9-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-7-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-6-0x0000000005BF0000-0x0000000005E0F000-memory.dmp
memory/3452-5-0x0000000005F50000-0x0000000005FE2000-memory.dmp
memory/3452-0-0x0000000000A10000-0x0000000000A28000-memory.dmp
memory/3452-2-0x00000000053E0000-0x00000000053F0000-memory.dmp
memory/3452-4-0x00000000063F0000-0x0000000006994000-memory.dmp
memory/3452-3-0x0000000005BF0000-0x0000000005E16000-memory.dmp
memory/3944-5025-0x0000000074A20000-0x00000000751D0000-memory.dmp
memory/3944-5014-0x0000000070070000-0x00000000700BC000-memory.dmp
memory/3944-5003-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/3944-5002-0x0000000074A20000-0x00000000751D0000-memory.dmp