Analysis
-
max time kernel
327s -
max time network
329s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30-05-2024 11:00
Behavioral task
behavioral1
Sample
Probiv.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Probiv.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Probiv.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
Probiv.exe
Resource
win11-20240508-en
General
-
Target
Probiv.exe
-
Size
67KB
-
MD5
613288a7e55550e864d86191542d9177
-
SHA1
22262078f189408184206777a67a64b9fb70e99a
-
SHA256
a9e49fdb9c43601c9e860d851f4d969550aaf43af8b84d178ea88257e8065a12
-
SHA512
22dd638b808a34fa64d354135407e8ac952cd96ce37ede335b055d590dcd360b63462233c159c1859e17707bf413f507494cc3656555fc606de195976dd47006
-
SSDEEP
1536:SmsKyHPhRopHbWTakbOzUyZX6I4wEON2GE:1OvbOoyb4wEONa
Malware Config
Extracted
xworm
registered-martial.gl.at.ply.gg:62460
-
Install_directory
%Temp%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2244-1-0x0000000000B00000-0x0000000000B18000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 1872 powershell.exe 1636 powershell.exe 3408 powershell.exe 2604 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Probiv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XClient.exe" Probiv.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeProbiv.exepid process 1872 powershell.exe 1872 powershell.exe 1872 powershell.exe 1636 powershell.exe 1636 powershell.exe 1636 powershell.exe 3408 powershell.exe 3408 powershell.exe 3408 powershell.exe 2604 powershell.exe 2604 powershell.exe 2604 powershell.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe 2244 Probiv.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Probiv.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2244 Probiv.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeIncreaseQuotaPrivilege 1872 powershell.exe Token: SeSecurityPrivilege 1872 powershell.exe Token: SeTakeOwnershipPrivilege 1872 powershell.exe Token: SeLoadDriverPrivilege 1872 powershell.exe Token: SeSystemProfilePrivilege 1872 powershell.exe Token: SeSystemtimePrivilege 1872 powershell.exe Token: SeProfSingleProcessPrivilege 1872 powershell.exe Token: SeIncBasePriorityPrivilege 1872 powershell.exe Token: SeCreatePagefilePrivilege 1872 powershell.exe Token: SeBackupPrivilege 1872 powershell.exe Token: SeRestorePrivilege 1872 powershell.exe Token: SeShutdownPrivilege 1872 powershell.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeSystemEnvironmentPrivilege 1872 powershell.exe Token: SeRemoteShutdownPrivilege 1872 powershell.exe Token: SeUndockPrivilege 1872 powershell.exe Token: SeManageVolumePrivilege 1872 powershell.exe Token: 33 1872 powershell.exe Token: 34 1872 powershell.exe Token: 35 1872 powershell.exe Token: 36 1872 powershell.exe Token: SeDebugPrivilege 1636 powershell.exe Token: SeIncreaseQuotaPrivilege 1636 powershell.exe Token: SeSecurityPrivilege 1636 powershell.exe Token: SeTakeOwnershipPrivilege 1636 powershell.exe Token: SeLoadDriverPrivilege 1636 powershell.exe Token: SeSystemProfilePrivilege 1636 powershell.exe Token: SeSystemtimePrivilege 1636 powershell.exe Token: SeProfSingleProcessPrivilege 1636 powershell.exe Token: SeIncBasePriorityPrivilege 1636 powershell.exe Token: SeCreatePagefilePrivilege 1636 powershell.exe Token: SeBackupPrivilege 1636 powershell.exe Token: SeRestorePrivilege 1636 powershell.exe Token: SeShutdownPrivilege 1636 powershell.exe Token: SeDebugPrivilege 1636 powershell.exe Token: SeSystemEnvironmentPrivilege 1636 powershell.exe Token: SeRemoteShutdownPrivilege 1636 powershell.exe Token: SeUndockPrivilege 1636 powershell.exe Token: SeManageVolumePrivilege 1636 powershell.exe Token: 33 1636 powershell.exe Token: 34 1636 powershell.exe Token: 35 1636 powershell.exe Token: 36 1636 powershell.exe Token: SeDebugPrivilege 3408 powershell.exe Token: SeIncreaseQuotaPrivilege 3408 powershell.exe Token: SeSecurityPrivilege 3408 powershell.exe Token: SeTakeOwnershipPrivilege 3408 powershell.exe Token: SeLoadDriverPrivilege 3408 powershell.exe Token: SeSystemProfilePrivilege 3408 powershell.exe Token: SeSystemtimePrivilege 3408 powershell.exe Token: SeProfSingleProcessPrivilege 3408 powershell.exe Token: SeIncBasePriorityPrivilege 3408 powershell.exe Token: SeCreatePagefilePrivilege 3408 powershell.exe Token: SeBackupPrivilege 3408 powershell.exe Token: SeRestorePrivilege 3408 powershell.exe Token: SeShutdownPrivilege 3408 powershell.exe Token: SeDebugPrivilege 3408 powershell.exe Token: SeSystemEnvironmentPrivilege 3408 powershell.exe Token: SeRemoteShutdownPrivilege 3408 powershell.exe Token: SeUndockPrivilege 3408 powershell.exe Token: SeManageVolumePrivilege 3408 powershell.exe Token: 33 3408 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Probiv.exepid process 2244 Probiv.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Probiv.exedescription pid process target process PID 2244 wrote to memory of 1872 2244 Probiv.exe powershell.exe PID 2244 wrote to memory of 1872 2244 Probiv.exe powershell.exe PID 2244 wrote to memory of 1636 2244 Probiv.exe powershell.exe PID 2244 wrote to memory of 1636 2244 Probiv.exe powershell.exe PID 2244 wrote to memory of 3408 2244 Probiv.exe powershell.exe PID 2244 wrote to memory of 3408 2244 Probiv.exe powershell.exe PID 2244 wrote to memory of 2604 2244 Probiv.exe powershell.exe PID 2244 wrote to memory of 2604 2244 Probiv.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Probiv.exe"C:\Users\Admin\AppData\Local\Temp\Probiv.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Probiv.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Probiv.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3408
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2604
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\Probiv.exe"C:\Users\Admin\AppData\Local\Temp\Probiv.exe"1⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\Probiv.exe"C:\Users\Admin\AppData\Local\Temp\Probiv.exe"1⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\Probiv.exe"C:\Users\Admin\AppData\Local\Temp\Probiv.exe"1⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\Probiv.exe"C:\Users\Admin\AppData\Local\Temp\Probiv.exe"1⤵PID:4044
-
C:\Users\Admin\Desktop\Probiv.exe"C:\Users\Admin\Desktop\Probiv.exe"1⤵PID:1860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD516c5fce5f7230eea11598ec11ed42862
SHA175392d4824706090f5e8907eee1059349c927600
SHA25687ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151
SHA512153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc
-
Filesize
3KB
MD5ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
Filesize
1KB
MD5ad40c5394163dc7d8d328ed96db4e89d
SHA1e40f3690fd0c92cbf1e543f56e89bb74c0aafa91
SHA256ba997e27e893f9874ef9196f7d579d32b6e1a72771975075f8eda1d8a80eb3fd
SHA51251bd352db1738f861df4b48206b4166446c5316c74df82a1c9c8b3afec2b7148bb4a8e055e6263ce689ee3acf21f43fc28369b356e8be9afffbda090dffc938d
-
Filesize
1KB
MD51fd34059361bdc28de9e9ab80a8a8443
SHA18ab7cf66866aff2721ffb9531cf937bb88df7db5
SHA256677f96167b847ae69e602cf8bed14bcbbe0fbb6002e9ba1a959716f5d62c96dd
SHA5125b763ba6724ab4afb289d52e208c887c92764d30e13ee44e5609127ccfcaafe59e9f97a9d05ec249e2afc237bb6e665a5682085bf17330abbcad3924abb357e5
-
Filesize
1KB
MD58c68c235aabee744c39a6dfeaebb8d22
SHA1f54334faa0f0ed47f452564d45bb6249dbad599d
SHA256f5cce118be8d0eedd8a55e31beb8088e0e8c00c18d84a1b1bf3eacab6daf75ba
SHA5124443085881cb2f11ff65de466df12eabe729496502542a06be12de9ccb06570beacbd181b5cc705f317e8302602dde9ca4870856a213717275d17cf88cd4f707
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a