Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 01:26
Static task
static1
Behavioral task
behavioral1
Sample
500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe
Resource
win10v2004-20240412-en
General
-
Target
500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe
-
Size
196KB
-
MD5
edd7441051bbf509ef1052d9f2a02c8f
-
SHA1
7338ef9ddb0b59228b31c6b7931fae04ace344e8
-
SHA256
500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30
-
SHA512
0aa4f2666213b571114cdd56c859200ab34a615cde57e67d142d4522369c74b8d4c37c9c95c97a76b93abbb0795ce698e4a888e646fdd2b05fe80f81da074f93
-
SSDEEP
3072:LhAMBSpVNwpB7/LaX6No7INoSXlb2Q4u3lriJYzr9B/erenNecMnq+ECqmIkk6:LaP+fvLW7IVXliQz3l//3Pyq+RqmI
Malware Config
Extracted
xworm
127.0.0.1:7000
91.92.252.220:7000
-
Install_directory
%Temp%
-
install_file
mstc.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Extracted
redline
IDS
91.92.252.220:9078
Signatures
-
Detect Xworm Payload 5 IoCs
Processes:
resource yara_rule C:\ProgramData\XClient.exe family_xworm behavioral1/memory/2572-13-0x0000000000BB0000-0x0000000000BCC000-memory.dmp family_xworm behavioral1/memory/2956-18-0x0000000002390000-0x00000000023D0000-memory.dmp family_xworm behavioral1/memory/268-81-0x0000000000370000-0x000000000038C000-memory.dmp family_xworm behavioral1/memory/3048-86-0x0000000001050000-0x000000000106C000-memory.dmp family_xworm -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\ProgramData\build.exe family_redline behavioral1/memory/2956-16-0x0000000000E40000-0x0000000000E5E000-memory.dmp family_redline behavioral1/memory/2956-18-0x0000000002390000-0x00000000023D0000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule C:\ProgramData\build.exe family_sectoprat behavioral1/memory/2956-16-0x0000000000E40000-0x0000000000E5E000-memory.dmp family_sectoprat behavioral1/memory/2956-18-0x0000000002390000-0x00000000023D0000-memory.dmp family_sectoprat -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs
Processes:
resource yara_rule C:\ProgramData\build.exe INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2956-16-0x0000000000E40000-0x0000000000E5E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2956-18-0x0000000002390000-0x00000000023D0000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects Windows executables referencing non-Windows User-Agents 5 IoCs
Processes:
resource yara_rule C:\ProgramData\XClient.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2572-13-0x0000000000BB0000-0x0000000000BCC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2956-18-0x0000000002390000-0x00000000023D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/268-81-0x0000000000370000-0x000000000038C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/3048-86-0x0000000001050000-0x000000000106C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables using Telegram Chat Bot 5 IoCs
Processes:
resource yara_rule C:\ProgramData\XClient.exe INDICATOR_SUSPICIOUS_EXE_TelegramChatBot behavioral1/memory/2572-13-0x0000000000BB0000-0x0000000000BCC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot behavioral1/memory/2956-18-0x0000000002390000-0x00000000023D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot behavioral1/memory/268-81-0x0000000000370000-0x000000000038C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot behavioral1/memory/3048-86-0x0000000001050000-0x000000000106C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_TelegramChatBot -
Drops startup file 2 IoCs
Processes:
XClient.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mstc.lnk XClient.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mstc.lnk XClient.exe -
Executes dropped EXE 5 IoCs
Processes:
XClient.exebuild.exemstc.exemstc.exemstc.exepid process 2572 XClient.exe 2956 build.exe 268 mstc.exe 3048 mstc.exe 2604 mstc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
XClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mstc.exe" XClient.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
XClient.exepid process 2572 XClient.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeXClient.exepid process 2428 powershell.exe 1064 powershell.exe 812 powershell.exe 2180 powershell.exe 2572 XClient.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
XClient.exebuild.exepowershell.exepowershell.exepowershell.exepowershell.exemstc.exemstc.exemstc.exedescription pid process Token: SeDebugPrivilege 2572 XClient.exe Token: SeDebugPrivilege 2956 build.exe Token: SeDebugPrivilege 2428 powershell.exe Token: SeDebugPrivilege 1064 powershell.exe Token: SeDebugPrivilege 812 powershell.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeDebugPrivilege 2572 XClient.exe Token: SeDebugPrivilege 268 mstc.exe Token: SeDebugPrivilege 3048 mstc.exe Token: SeDebugPrivilege 2604 mstc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
XClient.exepid process 2572 XClient.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exeXClient.exetaskeng.exedescription pid process target process PID 1984 wrote to memory of 2572 1984 500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe XClient.exe PID 1984 wrote to memory of 2572 1984 500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe XClient.exe PID 1984 wrote to memory of 2572 1984 500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe XClient.exe PID 1984 wrote to memory of 2956 1984 500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe build.exe PID 1984 wrote to memory of 2956 1984 500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe build.exe PID 1984 wrote to memory of 2956 1984 500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe build.exe PID 1984 wrote to memory of 2956 1984 500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe build.exe PID 2572 wrote to memory of 2428 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 2428 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 2428 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 1064 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 1064 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 1064 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 812 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 812 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 812 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 2180 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 2180 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 2180 2572 XClient.exe powershell.exe PID 2572 wrote to memory of 1540 2572 XClient.exe schtasks.exe PID 2572 wrote to memory of 1540 2572 XClient.exe schtasks.exe PID 2572 wrote to memory of 1540 2572 XClient.exe schtasks.exe PID 2480 wrote to memory of 268 2480 taskeng.exe mstc.exe PID 2480 wrote to memory of 268 2480 taskeng.exe mstc.exe PID 2480 wrote to memory of 268 2480 taskeng.exe mstc.exe PID 2480 wrote to memory of 3048 2480 taskeng.exe mstc.exe PID 2480 wrote to memory of 3048 2480 taskeng.exe mstc.exe PID 2480 wrote to memory of 3048 2480 taskeng.exe mstc.exe PID 2480 wrote to memory of 2604 2480 taskeng.exe mstc.exe PID 2480 wrote to memory of 2604 2480 taskeng.exe mstc.exe PID 2480 wrote to memory of 2604 2480 taskeng.exe mstc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe"C:\Users\Admin\AppData\Local\Temp\500b51771f03e61f1c46fc29c2a786201c123ae5f0369bd1664992bd7c434a30.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\XClient.exe"C:\ProgramData\XClient.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mstc.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mstc.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "mstc" /tr "C:\Users\Admin\AppData\Local\Temp\mstc.exe"3⤵
- Creates scheduled task(s)
-
C:\ProgramData\build.exe"C:\ProgramData\build.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {B6958196-F09F-4235-9105-E90729CFDB47} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mstc.exeC:\Users\Admin\AppData\Local\Temp\mstc.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\mstc.exeC:\Users\Admin\AppData\Local\Temp\mstc.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\mstc.exeC:\Users\Admin\AppData\Local\Temp\mstc.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\XClient.exeFilesize
83KB
MD55b7ac9829cdca0b5e82604191dcc1d4e
SHA15e944b6afea5db67b4d272a7b02bdf5501ca213f
SHA256bc8306a6f60583de0b2a2818f1f9d1df8e80ef29dcf46b9471e4697f219e1251
SHA512505491b019e948b14500867e927c9ab48642571733b944afc054922ed46a25eebbfae1615500e4755b0f022e5993cc4bd5124cf27c218a118070812e92bc1b33
-
C:\ProgramData\build.exeFilesize
95KB
MD5d32bddd3639f42733a78945885002128
SHA16dcfc09b8c86e79ac70a63132a5162d3616c6479
SHA25634dac9b900a3c810e466f9cac9ba5f0a062ff2be7719fc443cb23d0f8ac0390e
SHA512b28fc39e77245d5a52ae5d25ac363c95db8b20a960caabc7aa4f3339b2a8d27f7f92846e2a4173fd0f776be4034fbfe5e60b375eebb465dbe78017d8479ad511
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e491cf1c50f6e590cb11ef6345cc0ca3
SHA1ae514607266cbf00015ab19d62e1a26e448f2358
SHA256c8a917704079a26ebee31c75d85e4700ff66ecbaeadab799e3b8af3519edc2d8
SHA512c9c44b07eb83139cb2a71c6b0754f1afaf4d1a13b4a134cf69479688bc3e8b03d6f7fc53fdf7d197b2454c1c9561310f0c96c23a7fd408a34ee6c1afcea59928
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/268-83-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/268-82-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/268-81-0x0000000000370000-0x000000000038C000-memory.dmpFilesize
112KB
-
memory/812-53-0x000007FEEE4D0000-0x000007FEEEE6D000-memory.dmpFilesize
9.6MB
-
memory/812-55-0x0000000002DE0000-0x0000000002E60000-memory.dmpFilesize
512KB
-
memory/812-56-0x000007FEEE4D0000-0x000007FEEEE6D000-memory.dmpFilesize
9.6MB
-
memory/812-59-0x000007FEEE4D0000-0x000007FEEEE6D000-memory.dmpFilesize
9.6MB
-
memory/812-58-0x0000000002DE0000-0x0000000002E60000-memory.dmpFilesize
512KB
-
memory/812-57-0x0000000002DE0000-0x0000000002E60000-memory.dmpFilesize
512KB
-
memory/1064-44-0x0000000002BB0000-0x0000000002C30000-memory.dmpFilesize
512KB
-
memory/1064-47-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmpFilesize
9.6MB
-
memory/1064-46-0x0000000002BB0000-0x0000000002C30000-memory.dmpFilesize
512KB
-
memory/1064-42-0x0000000002BB0000-0x0000000002C30000-memory.dmpFilesize
512KB
-
memory/1064-37-0x000000001B640000-0x000000001B922000-memory.dmpFilesize
2.9MB
-
memory/1064-39-0x0000000002790000-0x0000000002798000-memory.dmpFilesize
32KB
-
memory/1064-40-0x0000000002BB0000-0x0000000002C30000-memory.dmpFilesize
512KB
-
memory/1064-38-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmpFilesize
9.6MB
-
memory/1064-41-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmpFilesize
9.6MB
-
memory/1984-0-0x00000000002E0000-0x0000000000318000-memory.dmpFilesize
224KB
-
memory/1984-15-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/1984-1-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/2180-66-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmpFilesize
9.6MB
-
memory/2180-68-0x0000000002D00000-0x0000000002D80000-memory.dmpFilesize
512KB
-
memory/2180-73-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmpFilesize
9.6MB
-
memory/2180-71-0x0000000002D00000-0x0000000002D80000-memory.dmpFilesize
512KB
-
memory/2180-72-0x0000000002D00000-0x0000000002D80000-memory.dmpFilesize
512KB
-
memory/2180-70-0x0000000002D00000-0x0000000002D80000-memory.dmpFilesize
512KB
-
memory/2180-69-0x000007FEEDB30000-0x000007FEEE4CD000-memory.dmpFilesize
9.6MB
-
memory/2428-24-0x000000001B720000-0x000000001BA02000-memory.dmpFilesize
2.9MB
-
memory/2428-31-0x000007FEEE4D0000-0x000007FEEEE6D000-memory.dmpFilesize
9.6MB
-
memory/2428-27-0x0000000001D80000-0x0000000001E00000-memory.dmpFilesize
512KB
-
memory/2428-25-0x0000000001EF0000-0x0000000001EF8000-memory.dmpFilesize
32KB
-
memory/2428-30-0x0000000001D80000-0x0000000001E00000-memory.dmpFilesize
512KB
-
memory/2428-29-0x0000000001D80000-0x0000000001E00000-memory.dmpFilesize
512KB
-
memory/2428-28-0x000007FEEE4D0000-0x000007FEEEE6D000-memory.dmpFilesize
9.6MB
-
memory/2428-26-0x000007FEEE4D0000-0x000007FEEEE6D000-memory.dmpFilesize
9.6MB
-
memory/2572-67-0x000000001B270000-0x000000001B2F0000-memory.dmpFilesize
512KB
-
memory/2572-12-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/2572-19-0x000000001B270000-0x000000001B2F0000-memory.dmpFilesize
512KB
-
memory/2572-13-0x0000000000BB0000-0x0000000000BCC000-memory.dmpFilesize
112KB
-
memory/2572-43-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/2604-90-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/2604-91-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/2956-16-0x0000000000E40000-0x0000000000E5E000-memory.dmpFilesize
120KB
-
memory/2956-17-0x0000000074500000-0x0000000074BEE000-memory.dmpFilesize
6.9MB
-
memory/2956-18-0x0000000002390000-0x00000000023D0000-memory.dmpFilesize
256KB
-
memory/2956-54-0x0000000002390000-0x00000000023D0000-memory.dmpFilesize
256KB
-
memory/2956-45-0x0000000074500000-0x0000000074BEE000-memory.dmpFilesize
6.9MB
-
memory/3048-87-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/3048-86-0x0000000001050000-0x000000000106C000-memory.dmpFilesize
112KB
-
memory/3048-88-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB