Resubmissions
03/05/2024, 17:26
240503-vz54gaef961003/05/2024, 17:25
240503-vy9p9sef751003/05/2024, 17:21
240503-vxajsaef4603/05/2024, 17:19
240503-vvvryaef241003/05/2024, 17:17
240503-vt5krabf8x1003/05/2024, 17:11
240503-vqjtwabf2t10Analysis
- max time kernel
40s - max time network
90s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
- submitted
03/05/2024, 17:19
General
- Target 54335453425234.exe
- Size 57KB
- Sample240503-vvvryaef24
- SHA256 002a55a722eb437d66039df4b8e16b32baa59ba4f3a180c0d5a0514e01dc7377
Malware Config
Extracted
-
xworm
-
0.tcp.eu.ngrok.io:15487
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Drops startup file 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54335453425234.exe"C:\Users\Admin\AppData\Local\Temp\54335453425234.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\tmobpf.txt2⤵
- Opens file in notepad (likely ransom note)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmobpf.txt
memory/1764-0-0x000007FEF5B13000-0x000007FEF5B14000-memory.dmp
memory/1764-1-0x0000000000ED0000-0x0000000000EE4000-memory.dmp
memory/1764-6-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp
memory/1764-7-0x0000000000700000-0x000000000070C000-memory.dmp
memory/1764-9-0x000007FEF5B13000-0x000007FEF5B14000-memory.dmp
memory/1764-11-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp
memory/1764-12-0x0000000000E90000-0x0000000000E9E000-memory.dmp