Analysis

  • max time kernel
    1047s
  • max time network
    1044s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 14:25

General

  • Target

    Obustro.exe

  • Size

    82KB

  • MD5

    b107fbdbd7e5a97172b3974216a78886

  • SHA1

    410f9c227a901e2721fd4471e8a5069bd6af43da

  • SHA256

    1ddab0ffb27f81d57aa99aff590c9a603157724362315228bd47914be4dbf6d2

  • SHA512

    b7485652c502a95a258d106166419dc3679e8a69906b7634dc440db9fa3db506a1c5597024fa0b275b556dbce55f51877bfef6d779817a0c83f51395bc734de6

  • SSDEEP

    1536:qih380x1gfPT9dOjquahM8+bEm3leW9Q6au4aOaQDb4mPMUf:NhVgf5EFWZ+bEmVeOcu4aOaQDb4va

Malware Config

Extracted

Family

xworm

C2

19.ip.gl.ply.gg:45758

ads-enabled.gl.at.ply.gg:45758

Attributes
  • Install_directory

    %AppData%

  • install_file

    detektivhuedblyat.exe

Signatures

  • Detect Xworm Payload 14 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 17 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 62 IoCs
  • Suspicious use of SendNotifyMessage 59 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Obustro.exe
    "C:\Users\Admin\AppData\Local\Temp\Obustro.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Obustro.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2816
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Obustro.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2608
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2828
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'detektivhuedblyat.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "detektivhuedblyat" /tr "C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2756
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {2DA570C6-BAC6-4F20-BA8C-40C4492ED7BA} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1872
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2232
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1868
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2680
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1612
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1056
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2252
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2644
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1524
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2752
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2152
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2672
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1632
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1844
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1836
    • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1776
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2148
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2832
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2196
      • C:\Users\Admin\AppData\Local\Temp\Obustro.exe
        "C:\Users\Admin\AppData\Local\Temp\Obustro.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1508
      • C:\Program Files\7-Zip\7zFM.exe
        "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Obustro.exe"
        1⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO837D19B9\version.txt
          2⤵
          • Opens file in notepad (likely ransom note)
          PID:2304

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\7zO837D19B9\version.txt

        Filesize

        1KB

        MD5

        4230e1121100316a114c7aa4df304c71

        SHA1

        e4c18efed44d30877b31e7763adc815e68feab49

        SHA256

        bb01715aba0e2ea0f3dd325c92a36827eff8d6431754cafac54e51703f408283

        SHA512

        42387317c908c07256390139dcc39d25786e6b305a3c1c50719133f3526c1deb78024a3a52ac731857f8a24a44952640dde1d063a3a7811e3f97e0ea3dc533ac

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

        Filesize

        7KB

        MD5

        087b56ce4122f1b75a1c92689cdabcc6

        SHA1

        9ed5f2f135660b8abea8ccb78b14dce6e70e79ba

        SHA256

        c1da1c32322504eee6650e34ea88fe878a9c4a301ed18ba523eb5630414e0665

        SHA512

        5d94625eaa0bca4e08912e3f9f275d6464a20edfdd374730da7a6470662a7f1c56679c84ecf80723c33a885956e89cfc7cae0e810fa401120661e0ebe059eb46

      • C:\Users\Admin\AppData\Roaming\detektivhuedblyat.exe

        Filesize

        82KB

        MD5

        b107fbdbd7e5a97172b3974216a78886

        SHA1

        410f9c227a901e2721fd4471e8a5069bd6af43da

        SHA256

        1ddab0ffb27f81d57aa99aff590c9a603157724362315228bd47914be4dbf6d2

        SHA512

        b7485652c502a95a258d106166419dc3679e8a69906b7634dc440db9fa3db506a1c5597024fa0b275b556dbce55f51877bfef6d779817a0c83f51395bc734de6

      • \??\PIPE\srvsvc

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • memory/1056-106-0x0000000000E60000-0x0000000000E7A000-memory.dmp

        Filesize

        104KB

      • memory/1524-112-0x0000000000050000-0x000000000006A000-memory.dmp

        Filesize

        104KB

      • memory/1612-104-0x00000000003B0000-0x00000000003CA000-memory.dmp

        Filesize

        104KB

      • memory/1632-120-0x0000000001360000-0x000000000137A000-memory.dmp

        Filesize

        104KB

      • memory/1868-84-0x00000000001F0000-0x000000000020A000-memory.dmp

        Filesize

        104KB

      • memory/1872-37-0x00000000000B0000-0x00000000000CA000-memory.dmp

        Filesize

        104KB

      • memory/2232-58-0x0000000000C00000-0x0000000000C1A000-memory.dmp

        Filesize

        104KB

      • memory/2252-108-0x00000000010D0000-0x00000000010EA000-memory.dmp

        Filesize

        104KB

      • memory/2372-33-0x000007FEF5533000-0x000007FEF5534000-memory.dmp

        Filesize

        4KB

      • memory/2372-32-0x00000000020D0000-0x0000000002150000-memory.dmp

        Filesize

        512KB

      • memory/2372-0-0x000007FEF5533000-0x000007FEF5534000-memory.dmp

        Filesize

        4KB

      • memory/2372-1-0x00000000002E0000-0x00000000002FA000-memory.dmp

        Filesize

        104KB

      • memory/2608-15-0x0000000001E10000-0x0000000001E18000-memory.dmp

        Filesize

        32KB

      • memory/2608-14-0x000000001B810000-0x000000001BAF2000-memory.dmp

        Filesize

        2.9MB

      • memory/2628-114-0x0000000000130000-0x000000000014A000-memory.dmp

        Filesize

        104KB

      • memory/2644-110-0x00000000011C0000-0x00000000011DA000-memory.dmp

        Filesize

        104KB

      • memory/2680-101-0x0000000000DA0000-0x0000000000DBA000-memory.dmp

        Filesize

        104KB

      • memory/2752-116-0x0000000000DC0000-0x0000000000DDA000-memory.dmp

        Filesize

        104KB

      • memory/2816-8-0x00000000021D0000-0x00000000021D8000-memory.dmp

        Filesize

        32KB

      • memory/2816-7-0x000000001B730000-0x000000001BA12000-memory.dmp

        Filesize

        2.9MB

      • memory/2816-6-0x0000000002CF0000-0x0000000002D70000-memory.dmp

        Filesize

        512KB

      • memory/2832-82-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

      • memory/2832-81-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

      • memory/2832-80-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

      • memory/2832-79-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB