Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 12:03

General

  • Target

    SUITLOCK.exe

  • Size

    5.1MB

  • MD5

    6f9ba18a04ebf182900a0f4b94b3537d

  • SHA1

    15634a3aa0a59e8154ad1ffdb5eeb8387055f213

  • SHA256

    443da78d2f9696220afbc3d4705228f75d268bc6079162b2b020ec94f140a0b1

  • SHA512

    6bead3d7421afef0e1e8b060c10db34eec908c863f57264c25d6cbabbd5b9b118418cc34fef3f366927f97def4782c8499780e5c008a62b9f2fbcd9af8adb8de

  • SSDEEP

    98304:NNadRPPlP93efT/RehdEyiFr9/LSsTxy/rSbIixFid6fa:NaPPlPYf10i9TSsFyTSbIcFg6

Malware Config

Extracted

Family

xworm

Version

5.0

C2

156.225.129.219:7000

Mutex

LOfxNhTNVvGzuUp6

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SUITLOCK.exe
    "C:\Users\Admin\AppData\Local\Temp\SUITLOCK.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Users\Admin\UNLOCK.exe
      "C:\Users\Admin\UNLOCK.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c mode 70,10
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1020
        • C:\Windows\system32\mode.com
          mode 70,10
          4⤵
            PID:5024
      • C:\Users\Admin\newupdate.exe
        "C:\Users\Admin\newupdate.exe"
        2⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4428
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\newupdate.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4384
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'newupdate.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1056
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\csrss'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:424
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'csrss'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3032

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      eb1ad317bd25b55b2bbdce8a28a74a94

      SHA1

      98a3978be4d10d62e7411946474579ee5bdc5ea6

      SHA256

      9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

      SHA512

      d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      cadef9abd087803c630df65264a6c81c

      SHA1

      babbf3636c347c8727c35f3eef2ee643dbcc4bd2

      SHA256

      cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

      SHA512

      7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      19a9aede3e8e2ec988f259f5376c05b1

      SHA1

      9c266bc2d25767e348f94a862fcfc2480af60ec4

      SHA256

      410fe8254ed16d5d9fabd39f5d462684354fa5a953cb827852cc570849ccb5d8

      SHA512

      cdcd954967a346088107509ba5f7a92de6e244106091acd98071d482a144d5da000ee1894eacd8ce5e8f94ab55381719791ce313512a656346422189c10d9d39

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tl51nncq.ypo.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\UNLOCK.exe

      Filesize

      5.0MB

      MD5

      36c166ba7ab01d11bc9eecfd87af3d63

      SHA1

      2872c0d4200037adfdbd2129b65a3cae51547f09

      SHA256

      b3d90d187c2b7f8068a447d296410dd279a3f39330dc5c57e1038ba6421bc548

      SHA512

      694260d62d61ca29b7393dbc059bfd01769cb6475eddd045dd309abaa07388e1e73ca2bceab855adca8f73157a5c4dfdbd25435bf6d62778285e7ed62508c191

    • C:\Users\Admin\newupdate.exe

      Filesize

      40KB

      MD5

      6663d561874fb21e3bd67c9e68f09ac0

      SHA1

      9f8ad93ba4e60844250d624e25a8d421281c6d94

      SHA256

      a8cfdcf2308be48989bc7993ceb61e0ecb7930f8a154b2e5d2c78f2f5a5c3802

      SHA512

      8ff50e5aa96e6600663b8e0935548c8cd1477b0c483c2f7ba0f8808ad6a21c48eb7655c87daeda6695d4ea4cc0db26161e1367eb712f67fb199c26bc5fcc3c6f

    • memory/2084-58-0x0000000140000000-0x00000001408BC000-memory.dmp

      Filesize

      8.7MB

    • memory/2084-51-0x0000000140080000-0x00000001403B0000-memory.dmp

      Filesize

      3.2MB

    • memory/2084-52-0x00007FFC84D70000-0x00007FFC84D72000-memory.dmp

      Filesize

      8KB

    • memory/2084-110-0x0000000140080000-0x00000001403B0000-memory.dmp

      Filesize

      3.2MB

    • memory/2084-53-0x00007FFC84D80000-0x00007FFC84D82000-memory.dmp

      Filesize

      8KB

    • memory/2084-54-0x0000000140000000-0x00000001408BC000-memory.dmp

      Filesize

      8.7MB

    • memory/4384-60-0x000001A114970000-0x000001A114992000-memory.dmp

      Filesize

      136KB

    • memory/4428-59-0x000000001B4B0000-0x000000001B4C0000-memory.dmp

      Filesize

      64KB

    • memory/4428-50-0x00007FFC66BF0000-0x00007FFC676B1000-memory.dmp

      Filesize

      10.8MB

    • memory/4428-48-0x00000000007D0000-0x00000000007E0000-memory.dmp

      Filesize

      64KB

    • memory/4428-109-0x00007FFC66BF0000-0x00007FFC676B1000-memory.dmp

      Filesize

      10.8MB

    • memory/4428-111-0x000000001B4B0000-0x000000001B4C0000-memory.dmp

      Filesize

      64KB

    • memory/4856-1-0x0000000000570000-0x0000000000A8E000-memory.dmp

      Filesize

      5.1MB

    • memory/4856-0-0x00007FFC66BF3000-0x00007FFC66BF5000-memory.dmp

      Filesize

      8KB