Analysis
-
max time kernel
120s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 06:43
Behavioral task
behavioral1
Sample
Svhost.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Svhost.exe
-
Size
34KB
-
MD5
c2856ccd6057ace3ee6f1e8078e0ac45
-
SHA1
eedd4f993a202b05ea1f82b72c25b35ffbc0a13c
-
SHA256
2fac7c2aefb6913bb05d047f139c5ac7e7c66b29da98a48f9dcfdd9493305cf0
-
SHA512
8454460da9f077b12358b87cd39a92739643057a2e598c36605c8ccacee87e7794d51127b0a953d4bdfcae55326f5e242c56d544ad380921c4d00ee05400c156
-
SSDEEP
384:JIvnqQOsp+5e+tlerboocLbLUZbXCaCrCHixxdspFAR8pkFTBLTIZwYGzcvw9IkZ:L2cHmOabCWzA9Fx9jOOjhf/ki
Malware Config
Extracted
Family
xworm
Version
5.0
C2
156.225.129.218:7005
Mutex
XMToaJ2c2kh5ew1F
Attributes
-
Install_directory
%Userprofile%
-
install_file
svchosts.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1896-1-0x0000000000200000-0x000000000020E000-memory.dmp family_xworm -
Drops startup file 2 IoCs
Processes:
Svhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchosts.lnk Svhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchosts.lnk Svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Svhost.exedescription pid process Token: SeDebugPrivilege 1896 Svhost.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1896-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmpFilesize
4KB
-
memory/1896-1-0x0000000000200000-0x000000000020E000-memory.dmpFilesize
56KB
-
memory/1896-6-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmpFilesize
9.9MB
-
memory/1896-7-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmpFilesize
4KB
-
memory/1896-8-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmpFilesize
9.9MB