General

  • Target

    NNCracker.exe

  • Size

    352KB

  • Sample

    240525-3xh5xsfb2z

  • MD5

    8d1220eb9c315ba42c84067aff8c55e2

  • SHA1

    e5a143f34840ef2f2b8fd9955e7e90ab0e0486e2

  • SHA256

    87f4168f6e4a1698685eec9fffe256d8dac7398b214f6b5ca6188ab17fafbdd2

  • SHA512

    9ff73f60af6c8253d8378a108fe2581dac7a400dc7f7a0e69503d85f430797320a067464a473462138e312323294c957bcbad1fe069b6b3250193b7ad81138ce

  • SSDEEP

    3072:H9hCibrK52spPjbtbyhSO6Kz4nDfoiyz98HzX5:H9hC1pPHtb4zUDQBh4

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:1337

104.28.229.13:1337

192.168.2.133:1337

104.28.197.13:1337

Attributes
  • Install_directory

    %ProgramData%

  • telegram

    https://api.telegram.org/bot6911706583:AAGIck5-GICDZLswgqJrJgL5L_TBxq7tj7Y/sendMessage?chat_id=6727135086

Targets

    • Target

      NNCracker.exe

    • Size

      352KB

    • MD5

      8d1220eb9c315ba42c84067aff8c55e2

    • SHA1

      e5a143f34840ef2f2b8fd9955e7e90ab0e0486e2

    • SHA256

      87f4168f6e4a1698685eec9fffe256d8dac7398b214f6b5ca6188ab17fafbdd2

    • SHA512

      9ff73f60af6c8253d8378a108fe2581dac7a400dc7f7a0e69503d85f430797320a067464a473462138e312323294c957bcbad1fe069b6b3250193b7ad81138ce

    • SSDEEP

      3072:H9hCibrK52spPjbtbyhSO6Kz4nDfoiyz98HzX5:H9hC1pPHtb4zUDQBh4

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks