Analysis

  • max time kernel
    565s
  • max time network
    386s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31-05-2024 09:00

General

  • Target

    проверка.exe

  • Size

    102KB

  • MD5

    58174445e23753c941d39dc0453ac348

  • SHA1

    40e3a9047c49cbae6818297adcd03896d28364c2

  • SHA256

    1e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171

  • SHA512

    523ef9adae27b83d87166be13e87944d3816cad08103b65ae2c964bf8828c0c949030e9e967d56b2bf40bba5b9466f8e4d21ccc220892c5f9365e2dd221fe072

  • SSDEEP

    1536:oBFpc8Z5dGYzabvawh+/C6vSX/QOcy/WPPqUs/uoDjSBSc7UtYVL:oa85dGCabvaw4/moOcy/R/1W0cgteL

Malware Config

Extracted

Family

xworm

C2

19.ip.gl.ply.gg:65468

speed-wheat.gl.at.ply.gg:65468

XWorm V5.2:123

Attributes
  • Install_directory

    %AppData%

  • install_file

    Delta.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\проверка.exe
    "C:\Users\Admin\AppData\Local\Temp\проверка.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\проверка.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:216
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'проверка.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1584
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Delta.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2192
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Delta.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:1296
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Delta" /tr "C:\Users\Admin\AppData\Roaming\Delta.exe"
      2⤵
      • Creates scheduled task(s)
      PID:1984
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:3480
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:3652
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:1992
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:2648
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:4824
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:3552
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:4664
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:868
  • C:\Users\Admin\AppData\Roaming\Delta.exe
    C:\Users\Admin\AppData\Roaming\Delta.exe
    1⤵
    • Executes dropped EXE
    PID:60

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Delta.exe.log

    Filesize

    654B

    MD5

    16c5fce5f7230eea11598ec11ed42862

    SHA1

    75392d4824706090f5e8907eee1059349c927600

    SHA256

    87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

    SHA512

    153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    ad5cd538ca58cb28ede39c108acb5785

    SHA1

    1ae910026f3dbe90ed025e9e96ead2b5399be877

    SHA256

    c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

    SHA512

    c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    fd41e1ba4835adec899ed7905d5039fd

    SHA1

    55c666452650cc077b47e615b84c622b4afc980d

    SHA256

    f8edbfd136092e1db709454ca04b104453b2f5578f11112833b05a5b0a54181a

    SHA512

    1601a9ee8bdcb83330adbef0a7060e4650f3243f0f7baa48f17af0f24859fea017f3fc5119a514f90162fcf5ce300359709cb1eb95200e33c153879421272b5b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    bdb89e4e6bb7f27b7e8991124fdaca34

    SHA1

    508ba7f68c8185214c131a33076b0743b332cdcd

    SHA256

    3c2b94113c7d7de88d0015202b3d3a54883a9a79a8295f97fec36debaf2555b9

    SHA512

    3278dab242e7fb5d8ad592874716f3187f6c05a7b62f7e64e9170a6515e91232cb04a7916adad7f1bd3fdfd939eb7ce041f5c2e8933f4d8449fe14433c359e58

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    f089ad0cb060f2a4ffb3d14964aba510

    SHA1

    d9d819af321d0f1f446a0b36ea06de9146f36e9e

    SHA256

    4ddfc128d83acbd6c5edab2b4a31bb62505a228ced3becb66fb587e5b3c9708d

    SHA512

    aa43ed02096a33b06775864fab1aaabf38577399047b4065da2b3372b659e0691f0ce9b21ff1507cf863d72fc6413c38f2c6c0d1a5bb7fcb52e27637199dc258

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y3ryx35o.itw.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\Users\Admin\AppData\Roaming\Delta.exe

    Filesize

    102KB

    MD5

    58174445e23753c941d39dc0453ac348

    SHA1

    40e3a9047c49cbae6818297adcd03896d28364c2

    SHA256

    1e5034d37e7751fb4039157219aee679bf76a8d3b0185a86c0d2255477a58171

    SHA512

    523ef9adae27b83d87166be13e87944d3816cad08103b65ae2c964bf8828c0c949030e9e967d56b2bf40bba5b9466f8e4d21ccc220892c5f9365e2dd221fe072

  • memory/216-10-0x000001C8F8840000-0x000001C8F88B6000-memory.dmp

    Filesize

    472KB

  • memory/216-41-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

    Filesize

    9.9MB

  • memory/216-48-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

    Filesize

    9.9MB

  • memory/216-52-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

    Filesize

    9.9MB

  • memory/216-20-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

    Filesize

    9.9MB

  • memory/216-11-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

    Filesize

    9.9MB

  • memory/216-9-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

    Filesize

    9.9MB

  • memory/216-6-0x000001C8F8690000-0x000001C8F86B2000-memory.dmp

    Filesize

    136KB

  • memory/2676-0-0x0000000000820000-0x0000000000840000-memory.dmp

    Filesize

    128KB

  • memory/2676-186-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2676-187-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2676-1-0x00007FFA5EE13000-0x00007FFA5EE14000-memory.dmp

    Filesize

    4KB