Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 12:28
Behavioral task
behavioral1
Sample
EZTEAM0.0.7.exe
Resource
win7-20240220-en
General
-
Target
EZTEAM0.0.7.exe
-
Size
7.8MB
-
MD5
79e6e964ad3a7e5b8008dc44553b784c
-
SHA1
63684848b7c4530aa24c96c6223fddd7e1417702
-
SHA256
a669abcbdbf3f91fcfdd6cb2d55c9ba68a020c11aaca6ddf0c5bbb5c234ed023
-
SHA512
7e7d9aa748766b12473b178ee95c728f266e86d14110deaf9eb1937ff5343a0b7aaf0c69388eb4a918a236e19b95a87035b20792e04627ce45c630bd02c45013
-
SSDEEP
196608:UuUTi2pHbUmUHtahgF8/LQS9fjvSG7LUIGmrl:gwmuahk8/LbxvSG7D1Z
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1233119648527159317/Az86qBZQwyED_alc1sGO6UWR18PzIJCJX0PM3XdL1VTOwZPXr0B4Rc6-GqAkKUjg4Jn2
Extracted
xworm
phentermine-partial.gl.at.ply.gg:36969
-
Install_directory
%AppData%
-
install_file
Client.exe
-
telegram
https://api.telegram.org/bot7080511499:AAGFFOA3S2vvwmEy85SIMhKHrMsAdBoLR2Y
Signatures
-
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral2/files/0x000b000000023401-4.dat family_xworm behavioral2/memory/1796-22-0x0000000000F40000-0x0000000000F58000-memory.dmp family_xworm behavioral2/memory/2124-26-0x00000294C9FD0000-0x00000294C9FE0000-memory.dmp family_xworm -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation EZTEAM0.0.7.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation EZTEAM.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.lnk EZTEAM.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.lnk EZTEAM.exe -
Executes dropped EXE 4 IoCs
pid Process 1796 EZTEAM.exe 2124 Chrome.exe 3672 Client.exe 3372 Client.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 freegeoip.app 12 freegeoip.app 37 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1772 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2124 Chrome.exe 2124 Chrome.exe 2124 Chrome.exe 2712 powershell.exe 2712 powershell.exe 2712 powershell.exe 4056 powershell.exe 4056 powershell.exe 4056 powershell.exe 4984 powershell.exe 4984 powershell.exe 4984 powershell.exe 1560 powershell.exe 1560 powershell.exe 1560 powershell.exe 1796 EZTEAM.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 1796 EZTEAM.exe Token: SeDebugPrivilege 2124 Chrome.exe Token: SeDebugPrivilege 2712 powershell.exe Token: SeDebugPrivilege 4056 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeDebugPrivilege 1560 powershell.exe Token: SeDebugPrivilege 1796 EZTEAM.exe Token: SeDebugPrivilege 3672 Client.exe Token: SeDebugPrivilege 3372 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1796 EZTEAM.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1276 wrote to memory of 1796 1276 EZTEAM0.0.7.exe 87 PID 1276 wrote to memory of 1796 1276 EZTEAM0.0.7.exe 87 PID 1276 wrote to memory of 2124 1276 EZTEAM0.0.7.exe 88 PID 1276 wrote to memory of 2124 1276 EZTEAM0.0.7.exe 88 PID 1796 wrote to memory of 2712 1796 EZTEAM.exe 100 PID 1796 wrote to memory of 2712 1796 EZTEAM.exe 100 PID 1796 wrote to memory of 4056 1796 EZTEAM.exe 103 PID 1796 wrote to memory of 4056 1796 EZTEAM.exe 103 PID 1796 wrote to memory of 4984 1796 EZTEAM.exe 105 PID 1796 wrote to memory of 4984 1796 EZTEAM.exe 105 PID 1796 wrote to memory of 1560 1796 EZTEAM.exe 107 PID 1796 wrote to memory of 1560 1796 EZTEAM.exe 107 PID 1796 wrote to memory of 1772 1796 EZTEAM.exe 110 PID 1796 wrote to memory of 1772 1796 EZTEAM.exe 110 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\EZTEAM0.0.7.exe"C:\Users\Admin\AppData\Local\Temp\EZTEAM0.0.7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\EZTEAM.exe"C:\Users\Admin\AppData\Local\Temp\EZTEAM.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\EZTEAM.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'EZTEAM.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Client.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Client.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Client" /tr "C:\Users\Admin\AppData\Roaming\Client.exe"3⤵
- Creates scheduled task(s)
PID:1772
-
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exe"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Users\Admin\AppData\Roaming\Client.exeC:\Users\Admin\AppData\Roaming\Client.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
C:\Users\Admin\AppData\Roaming\Client.exeC:\Users\Admin\AppData\Roaming\Client.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD59bc110200117a3752313ca2acaf8a9e1
SHA1fda6b7da2e7b0175b391475ca78d1b4cf2147cd3
SHA256c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb
SHA5121f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD50256bd284691ed0fc502ef3c8a7e58dc
SHA1dcdf69dc8ca8bf068f65d20ef1563bbe283e2413
SHA256e2fb83098e114084f51ed7187334f861ce670051046c39f338928296ca9a49cf
SHA512c5b29c1e0a15ddb68b0579848066774fa7cdc6f35087bbbf47c05a5c0dcc1eb3e61b2ddadfbded8c1ed9820e637596a9f08a97db8fb18000d168e6b159060c42
-
Filesize
303KB
MD50806acefdfc7d5602fb29b696edb0c64
SHA1ff456af5fecb477cc00fffbaa4c206d18a62ee6a
SHA256beecfc72917651d131028b60ab9a5dfb0b8e5e4ec60248321637048e06c524b7
SHA512aa9bf80089dd565e2a4fa0af41f42c033c8093f83e52020b6c86c4cafeb49b627d712de89625adfbbc537d60f8fa0525b3c02164f4e34900c64ca3fd4fee134e
-
Filesize
74KB
MD5ef36a6fed3a555b4aee8288dbe0143ee
SHA1b31be44e9e4767d7df123d742f32802aa343d0ec
SHA2564ab06ce2922222f591b776a0c6c332952ff24bbcf6f757692a6ed5f9b45cc67a
SHA51204d87228b20401ab5c7d36be3a217c09a413c671a28c016fa82fe5b19cf7b5579f15bf74212bd6a5fd141bb4e29897dc754bda20896323f8f60fc55a3e47a09c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82