Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26-05-2024 15:38

General

  • Target

    siski.exe

  • Size

    88KB

  • MD5

    a39a9dbad030467f590832a6ab2ff349

  • SHA1

    23b9baed2339451a3dc0d710024e4f010fc89be8

  • SHA256

    db17812e10401ae3cdc44e07272758c155e215ccc2d4859833d7a26e38706d92

  • SHA512

    1ea795f981ecf0abb66c2fc2e1704e5292e319d8ff8d24a7e52b05b03125dc24d46f3b80a5f89acedd7361f0adfc7150a3707f9d41a2b4202e7cd014d359232c

  • SSDEEP

    1536:f62bFTb1Y/aBjS2jklqQZyoJPbUu6Ejbg/YVk36H2VLOO/V2G/cR:t5TyCZjks0ymbttnrVkxLOO2McR

Malware Config

Extracted

Family

xworm

C2

character-estimate.gl.at.ply.gg:61192

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Chrome.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\siski.exe
    "C:\Users\Admin\AppData\Local\Temp\siski.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\siski.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:196
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'siski.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:520
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Chrome.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1200
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Chrome.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4340

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    ad5cd538ca58cb28ede39c108acb5785

    SHA1

    1ae910026f3dbe90ed025e9e96ead2b5399be877

    SHA256

    c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

    SHA512

    c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    d2e234d4418da3e3998a0e50cbbe18f0

    SHA1

    64ad02d3cf61309b6dc5dbe1732e2d145177fb52

    SHA256

    f5070bcbb12d49bdac970dc8dd76f5cd44de08d319a060e9de18d31c8a43c9fd

    SHA512

    738770fc023e3ed01b1223537cb0bf4cc07ad7fead7415b610cccb36cce7dffb66a1ceb1c1ec02b26402a994677ecfb80b90c542c8c6b8f5a5655735bf562e5a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    211593cd6723611b5ebf2a03404ecb9a

    SHA1

    a9e63470784a937751f63ac81ccd381583eaf0ab

    SHA256

    798626ac35e4effd0cff2e53ec6a2cd4ebcdf076ca3f022c4b26d52dab2c1d5d

    SHA512

    d77e5382f47454acdbccb35aa409241980f59e4a897233adc6bb4c8b09544ceb5566d3383058b59e9dd43ad9ab74b6ed90a0e3f1bf50a692db9360e16c577927

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    6b6a7f8236c91c29ab2de94263a92649

    SHA1

    3bd2dabad59fa88a74c3b7622fa9db9b8bd6b45d

    SHA256

    99acbf67c0733d7b0becce98acc8f477b8a98ff742f3ce95219a292539546a09

    SHA512

    9603cca3e4ce07bf1ba2416f412b41489cea28ec219327b35c017c3d206d391ce2b6f1f916bf15aeb4a4f5461446636a913f0417ba160078fd1b801948c6b6a3

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4sarzqs1.o3k.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • memory/196-7-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

    Filesize

    9.9MB

  • memory/196-12-0x000001A5640C0000-0x000001A564136000-memory.dmp

    Filesize

    472KB

  • memory/196-10-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

    Filesize

    9.9MB

  • memory/196-49-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

    Filesize

    9.9MB

  • memory/196-8-0x000001A54BA40000-0x000001A54BA62000-memory.dmp

    Filesize

    136KB

  • memory/2272-0-0x00007FFB3FAC3000-0x00007FFB3FAC4000-memory.dmp

    Filesize

    4KB

  • memory/2272-2-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2272-1-0x0000000000060000-0x000000000007C000-memory.dmp

    Filesize

    112KB

  • memory/2272-183-0x00007FFB3FAC0000-0x00007FFB404AC000-memory.dmp

    Filesize

    9.9MB