Malware Analysis Report

2024-11-16 13:37

Sample ID 240530-rm5emabd5v
Target проверка.exe
SHA256 1e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171

Threat Level: Known bad

The file проверка.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Xworm family

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Drops startup file

Executes dropped EXE

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 14:19

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 14:19

Reported

2024-05-30 14:50

Platform

win11-20240508-en

Max time kernel

1798s

Max time network

1806s

Command Line

"C:\Users\Admin\AppData\Local\Temp\проверка.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Delta.lnk C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Delta.lnk C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\Delta = "C:\\Users\\Admin\\AppData\\Roaming\\Delta.exe" C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Delta.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3096 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3096 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3096 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3096 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3096 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3096 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3096 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3096 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3096 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe C:\Windows\System32\schtasks.exe
PID 3096 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\проверка.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\проверка.exe

"C:\Users\Admin\AppData\Local\Temp\проверка.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\проверка.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'проверка.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Delta.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Delta.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Delta" /tr "C:\Users\Admin\AppData\Roaming\Delta.exe"

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

C:\Users\Admin\AppData\Roaming\Delta.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
GB 2.18.66.170:443 tcp
GB 2.18.66.170:443 tcp
NL 23.62.61.121:443 r.bing.com tcp
NL 23.62.61.121:443 r.bing.com tcp
NL 23.62.61.121:443 r.bing.com tcp
NL 23.62.61.121:443 r.bing.com tcp
NL 23.62.61.121:443 r.bing.com tcp
NL 23.62.61.121:443 r.bing.com tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
BE 104.68.66.114:443 cxcs.microsoft.net tcp
NL 23.62.61.90:443 www.bing.com tcp
GB 2.18.66.170:443 tcp
FR 40.79.150.120:443 browser.pipe.aria.microsoft.com tcp
US 4.150.240.254:443 arm-ring.msedge.net tcp
BR 191.233.176.51:443 5a58a93e72647c4aadbe563a7975596b.azr.footprintdns.com tcp
US 8.8.8.8:53 254.240.150.4.in-addr.arpa udp
NO 51.13.112.137:443 b38900dacbc01b628be705207bd9c09c.azr.footprintdns.com tcp
FR 152.199.21.118:443 static-ecst.licdn.com tcp
US 13.107.136.254:443 spo-ring.msedge.net tcp
GB 51.143.210.130:443 direct.management.azure.com tcp
NO 51.13.112.137:443 b38900dacbc01b628be705207bd9c09c.azr.footprintdns.com tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 8.8.8.8:53 19.ip.gl.ply.gg udp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 8.8.8.8:53 speed-wheat.gl.at.ply.gg udp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 8.8.8.8:53 19.ip.gl.ply.gg udp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 8.8.8.8:53 speed-wheat.gl.at.ply.gg udp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 8.8.8.8:53 19.ip.gl.ply.gg udp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 8.8.8.8:53 speed-wheat.gl.at.ply.gg udp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 8.8.8.8:53 19.ip.gl.ply.gg udp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 147.185.221.19:65468 19.ip.gl.ply.gg tcp
US 8.8.8.8:53 speed-wheat.gl.at.ply.gg udp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp
US 147.185.221.19:65468 speed-wheat.gl.at.ply.gg tcp

Files

memory/3096-0-0x00007FFA51183000-0x00007FFA51185000-memory.dmp

memory/3096-1-0x0000000000970000-0x0000000000990000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gcbjo5um.a0z.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4628-10-0x0000014BE37D0000-0x0000014BE37F2000-memory.dmp

memory/4628-11-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

memory/4628-12-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

memory/4628-13-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

memory/4628-14-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

memory/4628-15-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

memory/4628-18-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 5ba388a6597d5e09191c2c88d2fdf598
SHA1 13516f8ec5a99298f6952438055c39330feae5d8
SHA256 e6b6223094e8fc598ad12b3849e49f03a141ccd21e0eaa336f81791ad8443eca
SHA512 ead2a2b5a1c2fad70c1cf570b2c9bfcb7364dd9f257a834eb819e55b8fee78e3f191f93044f07d51c259ca77a90ee8530f9204cbae080fba1d5705e1209f5b19

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 687b3558d687becb30ad8f90997723cc
SHA1 fb326d7d105aba4d26e1764e73fd124cad23f298
SHA256 5283507c63132fdaf5d64bb0a09bcd6ae6d412a4df0be934268bf8e774207ece
SHA512 f827d61fad06764cefbca1688b8b2df7c07a1080be42f524de9765650382db84151ee90dd74b6568ea6f5bc582399695ec2c1c598256076f2dc91ff250450abd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e07eea85a8893f23fb814cf4b3ed974c
SHA1 8a8125b2890bbddbfc3531d0ee4393dbbf5936fe
SHA256 83387ce468d717a7b4ba238af2273da873b731a13cc35604f775a31fa0ac70ea
SHA512 9d4808d8a261005391388b85da79e4c5396bdded6e7e5ce3a3a23e7359d1aa1fb983b4324f97e0afec6e8ed9d898322ca258dd7cda654456dd7e84c9cbd509df

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 64497dba662bee5d7ae7a3c76a72ed88
SHA1 edc027042b9983f13d074ba9eed8b78e55e4152e
SHA256 ca69ebbd2c9c185f0647fb2122d7a26e7d23af06a1950fb25ac327d869687b47
SHA512 25da69ec86ba0df6c7da60f722cc2919c59c91f2bb03137e0e87771936e5271522d48eef98030a0da41f7a707d82221d35fb016f8bb9a294e87be114adbe3522

memory/3096-54-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

memory/3096-55-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

C:\Users\Admin\AppData\Roaming\Delta.exe

MD5 58174445e23753c941d39dc0453ac348
SHA1 40e3a9047c49cbae6818297adcd03896d28364c2
SHA256 1e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171
SHA512 523ef9adae27b83d87166be13e87944d3816cad08103b65ae2c964bf8828c0c949030e9e967d56b2bf40bba5b9466f8e4d21ccc220892c5f9365e2dd221fe072

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Delta.exe.log

MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 14:19

Reported

2024-05-30 14:21

Platform

android-33-x64-arm64-20240514-en

Max time network

6s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.228:443 udp
GB 142.250.187.228:443 tcp

Files

N/A