Malware Analysis Report

2024-11-16 13:38

Sample ID 240530-gx7bvsaa92
Target 4e2b6ba1d497e94c32d71d48df0082fe95c97ce3ad20f2e1ebca82af86d11bee
SHA256 4e2b6ba1d497e94c32d71d48df0082fe95c97ce3ad20f2e1ebca82af86d11bee
Tags
xworm evasion execution persistence rat themida trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4e2b6ba1d497e94c32d71d48df0082fe95c97ce3ad20f2e1ebca82af86d11bee

Threat Level: Known bad

The file 4e2b6ba1d497e94c32d71d48df0082fe95c97ce3ad20f2e1ebca82af86d11bee was found to be: Known bad.

Malicious Activity Summary

xworm evasion execution persistence rat themida trojan

Xworm

Detect Xworm Payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Command and Scripting Interpreter: PowerShell

Themida packer

Checks BIOS information in registry

Checks computer location settings

Drops startup file

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Unsigned PE

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 06:12

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 06:12

Reported

2024-05-30 06:14

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.lnk C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.lnk C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "C:\\ProgramData\\cmd.exe" C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1636 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1636 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\schtasks.exe
PID 1636 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\schtasks.exe
PID 1636 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe

"C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\cmd.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cmd.exe'

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "cmd" /tr "C:\ProgramData\cmd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
N/A 127.0.0.1:7000 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 beshomandotestbesnd.run.place udp
US 45.88.186.125:7000 beshomandotestbesnd.run.place tcp
US 8.8.8.8:53 125.186.88.45.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

memory/1636-0-0x00000000000C0000-0x0000000000524000-memory.dmp

memory/1636-5-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-4-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-3-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-2-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-1-0x0000000077180000-0x0000000077181000-memory.dmp

memory/1636-6-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-9-0x00000000000C0000-0x0000000000524000-memory.dmp

memory/1636-10-0x0000000004EB0000-0x0000000004F4C000-memory.dmp

memory/2352-11-0x00000000029B0000-0x00000000029E6000-memory.dmp

memory/2352-12-0x0000000077160000-0x0000000077250000-memory.dmp

memory/2352-14-0x0000000077160000-0x0000000077250000-memory.dmp

memory/2352-13-0x0000000077160000-0x0000000077250000-memory.dmp

memory/2352-15-0x0000000005440000-0x0000000005A68000-memory.dmp

memory/2352-16-0x0000000005A70000-0x0000000005A92000-memory.dmp

memory/2352-17-0x0000000005B90000-0x0000000005BF6000-memory.dmp

memory/2352-18-0x0000000005CB0000-0x0000000005D16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nncu3lyv.b4i.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2352-28-0x0000000005D20000-0x0000000006074000-memory.dmp

memory/2352-29-0x00000000062E0000-0x00000000062FE000-memory.dmp

memory/2352-30-0x0000000006320000-0x000000000636C000-memory.dmp

memory/2352-31-0x0000000077160000-0x0000000077250000-memory.dmp

memory/2352-32-0x00000000068C0000-0x00000000068F2000-memory.dmp

memory/2352-33-0x000000006FE40000-0x000000006FE8C000-memory.dmp

memory/2352-43-0x0000000006900000-0x000000000691E000-memory.dmp

memory/2352-45-0x0000000077160000-0x0000000077250000-memory.dmp

memory/2352-44-0x0000000077160000-0x0000000077250000-memory.dmp

memory/2352-46-0x00000000074E0000-0x0000000007583000-memory.dmp

memory/2352-47-0x0000000007C60000-0x00000000082DA000-memory.dmp

memory/2352-48-0x0000000007610000-0x000000000762A000-memory.dmp

memory/2352-49-0x0000000007680000-0x000000000768A000-memory.dmp

memory/2352-50-0x0000000007890000-0x0000000007926000-memory.dmp

memory/2352-51-0x0000000007810000-0x0000000007821000-memory.dmp

memory/2352-52-0x0000000007840000-0x000000000784E000-memory.dmp

memory/2352-53-0x0000000007850000-0x0000000007864000-memory.dmp

memory/2352-54-0x0000000007950000-0x000000000796A000-memory.dmp

memory/2352-55-0x0000000007930000-0x0000000007938000-memory.dmp

memory/2352-58-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-66-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-65-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-64-0x0000000077180000-0x0000000077181000-memory.dmp

memory/1100-63-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1100-62-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-61-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-60-0x00000000000C0000-0x0000000000524000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/1100-76-0x0000000005B20000-0x0000000005E74000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b252608695f6f0639d21d46c1f3a062d
SHA1 e198310f5759a11f209b1b90791a5769df6a51ae
SHA256 a4ac14d8db5ff28e1f0fad9dd77d82828fc9c9bbe382165a50093ba8220dd480
SHA512 c79cc414deec1766a2bf505912dc0b05fabd8a9f8a4c8dc80c1c238441df76cc766ecf2a572d4b0054af5fad702435bac6690a63419a168000cb7215051ae9c3

memory/1100-78-0x000000006FE40000-0x000000006FE8C000-memory.dmp

memory/1100-89-0x0000000077160000-0x0000000077250000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 dba57fee6f5886e871787a7bc8fb1b45
SHA1 c8a878f79c09364f2a88db24805164902dd56c21
SHA256 e2948613da1b47ae52b6cd5a4fc0d324fb5ba953b2dff0abe054661d4d1d1bd3
SHA512 d1922f939301af6106acb7b9d96e53c9dbc9180fac8ce7a95c9d01039fd9b1e7f28dbbdea4ef3fad30fa0bba2b1710544727032d813fc04bdef08e24aefc0b6f

memory/5064-100-0x000000006FE40000-0x000000006FE8C000-memory.dmp

memory/1636-111-0x0000000077160000-0x0000000077250000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 96148a60b8ecee9ca759c906bbf54ae6
SHA1 e924261eb8ccb1200ec7c3e543bbf5a692afe5b0
SHA256 3109e9194ba645cf2594a9e9e94b87c059f7dd845470db24ed3b04e6cf9483cb
SHA512 7dd7ab71918a85abd2e9b5052feb7257883d33f3c45375a5ca935663f6a5fcd92ce33c8aeafec474f217e7972623a34144d509b5fb53c43ce3f9b6e7c23643b7

memory/2716-123-0x000000006FE40000-0x000000006FE8C000-memory.dmp

memory/1636-133-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-134-0x0000000077160000-0x0000000077250000-memory.dmp

memory/1636-137-0x0000000006320000-0x00000000068C4000-memory.dmp

memory/1636-138-0x00000000068D0000-0x0000000006962000-memory.dmp

memory/1636-139-0x0000000006B70000-0x0000000006B7A000-memory.dmp

memory/1636-140-0x0000000077160000-0x0000000077250000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 06:12

Reported

2024-05-30 06:14

Platform

win7-20240221-en

Max time kernel

147s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.lnk C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cmd.lnk C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "C:\\ProgramData\\cmd.exe" C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2020 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2020 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2020 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\schtasks.exe
PID 2020 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe

"C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\cmd.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cmd.exe'

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "cmd" /tr "C:\ProgramData\cmd.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {7E9A9639-1098-4835-9202-C78919E0893B} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:7000 tcp
US 8.8.8.8:53 beshomandotestbesnd.run.place udp
US 45.88.186.125:7000 beshomandotestbesnd.run.place tcp

Files

memory/2020-1-0x0000000076574000-0x0000000076575000-memory.dmp

memory/2020-0-0x0000000000090000-0x00000000004F4000-memory.dmp

memory/2020-5-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-4-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-3-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-8-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-12-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-11-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-10-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-22-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-21-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-20-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-19-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-23-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-18-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-17-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-16-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-15-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-14-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-13-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-9-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-7-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-6-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-2-0x0000000076560000-0x0000000076670000-memory.dmp

memory/2020-27-0x0000000000090000-0x00000000004F4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 2e99ba88c1475f144fa27d309c9e8abd
SHA1 381a424e80e8b21c0590e8f416b70da886f36393
SHA256 b07d2f3cd0badacc9b06f657b0ebb98134032923e59e2ee3704c2ad3fe086e91
SHA512 81e934a43b3501aad2dac1c7214bbd536fd49d22a9eebe3244ca96bd9ca3d153aa33196dfa2287496238bf99427de7a9461ca74416f9b7dc486a8dc24ed7faa6

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2020-48-0x0000000076574000-0x0000000076575000-memory.dmp