Analysis
-
max time kernel
147s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 03:00
Behavioral task
behavioral1
Sample
shexwormonmymemztilliminoxide.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
shexwormonmymemztilliminoxide.exe
Resource
win10v2004-20240419-en
General
-
Target
shexwormonmymemztilliminoxide.exe
-
Size
41KB
-
MD5
14f963e28858c6c3f653048a83621c89
-
SHA1
8c3a1d7d823e19558d80f35b0ee7d88f868ab5c6
-
SHA256
355b67101ba439f05337234d028ecba6641db094c6251aee15369f767c12dc3b
-
SHA512
2b6cc20e3b24752120ed007d8f07ba44c38bb964ab76b9dcb9d4f745db82450653dd6b5608812ba1bc325dc9e649ae1fb3600e6ad61565e7046ea4ed199a4bb2
-
SSDEEP
768:xTFHrDMcksBqaEAOrHA7tF5PM96maOwh23EihHJ:XwcGvAwAxFS96maOwwlx
Malware Config
Extracted
xworm
5.0
127.0.0.1:38630
147.185.221.19:38630
bay-currencies.gl.at.ply.gg:38630
and-organized.gl.at.ply.gg:38630
community-excess.gl.at.ply.gg:38630
TelZ6nrHgxVFZl6W
-
Install_directory
%AppData%
-
install_file
runbroker.exe
Signatures
-
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1708-0-0x0000000000A40000-0x0000000000A50000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\runbroker.exe family_xworm behavioral1/memory/2444-11-0x00000000013C0000-0x00000000013D0000-memory.dmp family_xworm -
Drops startup file 2 IoCs
Processes:
shexwormonmymemztilliminoxide.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runbroker.lnk shexwormonmymemztilliminoxide.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runbroker.lnk shexwormonmymemztilliminoxide.exe -
Executes dropped EXE 3 IoCs
Processes:
runbroker.exerunbroker.exerunbroker.exepid process 2444 runbroker.exe 940 runbroker.exe 2692 runbroker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
shexwormonmymemztilliminoxide.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\runbroker = "C:\\Users\\Admin\\AppData\\Roaming\\runbroker.exe" shexwormonmymemztilliminoxide.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
shexwormonmymemztilliminoxide.exepid process 1708 shexwormonmymemztilliminoxide.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
shexwormonmymemztilliminoxide.exerunbroker.exerunbroker.exerunbroker.exedescription pid process Token: SeDebugPrivilege 1708 shexwormonmymemztilliminoxide.exe Token: SeDebugPrivilege 1708 shexwormonmymemztilliminoxide.exe Token: SeDebugPrivilege 2444 runbroker.exe Token: SeDebugPrivilege 940 runbroker.exe Token: SeDebugPrivilege 2692 runbroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
shexwormonmymemztilliminoxide.exepid process 1708 shexwormonmymemztilliminoxide.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
shexwormonmymemztilliminoxide.exetaskeng.exedescription pid process target process PID 1708 wrote to memory of 2528 1708 shexwormonmymemztilliminoxide.exe schtasks.exe PID 1708 wrote to memory of 2528 1708 shexwormonmymemztilliminoxide.exe schtasks.exe PID 1708 wrote to memory of 2528 1708 shexwormonmymemztilliminoxide.exe schtasks.exe PID 2388 wrote to memory of 2444 2388 taskeng.exe runbroker.exe PID 2388 wrote to memory of 2444 2388 taskeng.exe runbroker.exe PID 2388 wrote to memory of 2444 2388 taskeng.exe runbroker.exe PID 2388 wrote to memory of 940 2388 taskeng.exe runbroker.exe PID 2388 wrote to memory of 940 2388 taskeng.exe runbroker.exe PID 2388 wrote to memory of 940 2388 taskeng.exe runbroker.exe PID 2388 wrote to memory of 2692 2388 taskeng.exe runbroker.exe PID 2388 wrote to memory of 2692 2388 taskeng.exe runbroker.exe PID 2388 wrote to memory of 2692 2388 taskeng.exe runbroker.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\shexwormonmymemztilliminoxide.exe"C:\Users\Admin\AppData\Local\Temp\shexwormonmymemztilliminoxide.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "runbroker" /tr "C:\Users\Admin\AppData\Roaming\runbroker.exe"2⤵
- Creates scheduled task(s)
PID:2528
-
C:\Windows\system32\taskeng.exetaskeng.exe {17360BAC-3811-4DD3-B62D-391EA41DB2BB} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Roaming\runbroker.exeC:\Users\Admin\AppData\Roaming\runbroker.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2444 -
C:\Users\Admin\AppData\Roaming\runbroker.exeC:\Users\Admin\AppData\Roaming\runbroker.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:940 -
C:\Users\Admin\AppData\Roaming\runbroker.exeC:\Users\Admin\AppData\Roaming\runbroker.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\runbroker.exeFilesize
41KB
MD514f963e28858c6c3f653048a83621c89
SHA18c3a1d7d823e19558d80f35b0ee7d88f868ab5c6
SHA256355b67101ba439f05337234d028ecba6641db094c6251aee15369f767c12dc3b
SHA5122b6cc20e3b24752120ed007d8f07ba44c38bb964ab76b9dcb9d4f745db82450653dd6b5608812ba1bc325dc9e649ae1fb3600e6ad61565e7046ea4ed199a4bb2
-
memory/1708-0-0x0000000000A40000-0x0000000000A50000-memory.dmpFilesize
64KB
-
memory/1708-1-0x000007FEF4E40000-0x000007FEF582C000-memory.dmpFilesize
9.9MB
-
memory/1708-2-0x000000001B3D0000-0x000000001B450000-memory.dmpFilesize
512KB
-
memory/1708-7-0x000007FEF4E40000-0x000007FEF582C000-memory.dmpFilesize
9.9MB
-
memory/2444-11-0x00000000013C0000-0x00000000013D0000-memory.dmpFilesize
64KB