Analysis

  • max time kernel
    149s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26-05-2024 02:51

General

  • Target

    c769ef621852a1cd8219c535827fcbce8ffb301eece3d34e8cf89db3e7452424.exe

  • Size

    81KB

  • MD5

    48288bec5481f6f9cd06650bd69709cf

  • SHA1

    9a5cf4bfe69765120a5150a8f8983afee07b7005

  • SHA256

    c769ef621852a1cd8219c535827fcbce8ffb301eece3d34e8cf89db3e7452424

  • SHA512

    b1df25415674e06b625c3385f5ddd17f37fb992c863fb48d6ae73316a0447c647a7ca602e92e15dc9905594c1f55b1fe6cf30346dbddf6603fd3b28e964f471b

  • SSDEEP

    1536:CMbWRTlmZ6Zzevqkklj0D0VyQx/Sc/NbAqFaGaeo6HO90jz0vKc1:pbYZm0zUY0OLx/S4bxROS0v1

Malware Config

Extracted

Family

xworm

C2

lot-feeds.gl.at.ply.gg:55815

Attributes
  • Install_directory

    %AppData%

  • install_file

    RuntimeBroker.exe

Signatures

  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Detects Windows executables referencing non-Windows User-Agents 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c769ef621852a1cd8219c535827fcbce8ffb301eece3d34e8cf89db3e7452424.exe
    "C:\Users\Admin\AppData\Local\Temp\c769ef621852a1cd8219c535827fcbce8ffb301eece3d34e8cf89db3e7452424.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c769ef621852a1cd8219c535827fcbce8ffb301eece3d34e8cf89db3e7452424.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'c769ef621852a1cd8219c535827fcbce8ffb301eece3d34e8cf89db3e7452424.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2876
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2476
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3032
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2596
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {C44C93A2-480D-4BA1-9D4C-119D41200222} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1076
    • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:896
    • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    62768c92b66a5390a18f9712a8162a0b

    SHA1

    3102cdc773de4af533bef82ca23cda62d66cf951

    SHA256

    5aa126ab7b4411043a3cf65e7d95128a9632af9d1792b697b65ab3cb934caa81

    SHA512

    1468e7cc1e472c5876107b87fa636bd504b471c51cf8a7f9b2371e36d80a618d006c5bfb7206b35f54a06b5145fd1b0126c721e0ca15cf708b819a9f0580f296

  • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

    Filesize

    81KB

    MD5

    48288bec5481f6f9cd06650bd69709cf

    SHA1

    9a5cf4bfe69765120a5150a8f8983afee07b7005

    SHA256

    c769ef621852a1cd8219c535827fcbce8ffb301eece3d34e8cf89db3e7452424

    SHA512

    b1df25415674e06b625c3385f5ddd17f37fb992c863fb48d6ae73316a0447c647a7ca602e92e15dc9905594c1f55b1fe6cf30346dbddf6603fd3b28e964f471b

  • memory/896-39-0x00000000009C0000-0x00000000009DA000-memory.dmp

    Filesize

    104KB

  • memory/1076-34-0x00000000000A0000-0x00000000000BA000-memory.dmp

    Filesize

    104KB

  • memory/1684-2-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

    Filesize

    9.9MB

  • memory/1684-1-0x0000000000830000-0x000000000084A000-memory.dmp

    Filesize

    104KB

  • memory/1684-0-0x000007FEF5B43000-0x000007FEF5B44000-memory.dmp

    Filesize

    4KB

  • memory/1684-35-0x000007FEF5B43000-0x000007FEF5B44000-memory.dmp

    Filesize

    4KB

  • memory/1684-36-0x000007FEF5B40000-0x000007FEF652C000-memory.dmp

    Filesize

    9.9MB

  • memory/2628-7-0x0000000002890000-0x0000000002910000-memory.dmp

    Filesize

    512KB

  • memory/2628-8-0x000000001B6A0000-0x000000001B982000-memory.dmp

    Filesize

    2.9MB

  • memory/2628-9-0x0000000001E80000-0x0000000001E88000-memory.dmp

    Filesize

    32KB

  • memory/2876-15-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

    Filesize

    2.9MB

  • memory/2876-16-0x0000000001D20000-0x0000000001D28000-memory.dmp

    Filesize

    32KB