Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
28/04/2024, 14:22
General
-
Target
planetx_loader_crack.exe
-
Size
138KB
-
MD5
aa5acfcc04c0d2612b06a9aa800ef0f7
-
SHA1
291f3cc04f2973b5bbf70e7e04ac51ce8d8a2c1f
-
SHA256
971ff1183980dc1211bd71e2993b441df7fc082ac362c1964f5278fcf093d026
-
SHA512
24772ebab68740405ccc77027f3f4e022d37dfe7cb69d6f2a555191142ea936b8761850db37c1d2070f30e53c0f1bce74e948259930403d632a6d7715242cb32
-
SSDEEP
3072:TayC6ykbvcOznBz65/M6If+3Js+3JFkKeTnu:Tg6bdxBt25
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:3878
understand-heroes.gl.at.ply.gg:3878
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/4896-0-0x0000000000C40000-0x0000000000C68000-memory.dmp family_xworm -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4896 planetx_loader_crack.exe Token: SeDebugPrivilege 3676 taskmgr.exe Token: SeSystemProfilePrivilege 3676 taskmgr.exe Token: SeCreateGlobalPrivilege 3676 taskmgr.exe Token: 33 3676 taskmgr.exe Token: SeIncBasePriorityPrivilege 3676 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\planetx_loader_crack.exe"C:\Users\Admin\AppData\Local\Temp\planetx_loader_crack.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3676