Overview

overview

10

Static

static

10

tjFUD.exe

windows7-x64

10

tjFUD.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 05:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tjFUD.exe

  • Size

    40KB

  • MD5

    9126c26063b71116148ea1f40db8c941

  • SHA1

    300cdd5589e1ce8642a328f5e80f4246e9d0b062

  • SHA256

    28a9ed9884a7f52e49a8026b03b757422a7e3d3a594e6cb7a13946191650b78a

  • SHA512

    afff315fdd006cbf2589845700f2433b57c6062497b4f1b59d4096bafe3acee6fca81e4a15f05443dd03f39362eabd0c03312dec6e0dc56d22cb7f9f65071a8f

  • SSDEEP

    768:kKpxOlNtidwAmJRXFuO5tF5PT95lvOMh23Ep:k/MWAmJ1FuOLFx95ZOMoW

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:12547

147.185.221.19:12547

bay-currencies.gl.at.ply.gg:12547

and-organized.gl.at.ply.gg:12547
Mutex

T8blWdnjot1TC8dy

Attributes
  • Install_directory

    %AppData%

  • install_file

    runbroker.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tjFUD.exe
    "C:\Users\Admin\AppData\Local\Temp\tjFUD.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3012
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4244 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2776

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3012-0-0x0000000000FE0000-0x0000000000FF0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3012-1-0x00007FFE5FD40000-0x00007FFE60801000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/3012-2-0x000000001BC60000-0x000000001BC70000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3012-7-0x00007FFE5FD40000-0x00007FFE60801000-memory.dmp
      Filesize

      10.8MB

      Download