Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 16:06
Behavioral task
behavioral1
Sample
Onioncrack.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
Onioncrack.exe
-
Size
206KB
-
MD5
166cd568396c15d96cc171fd9662c430
-
SHA1
ae4c4d7f9d7d823fead036878bc832e84ce8cf8e
-
SHA256
ef1eeafff3219798e7810a3653a680104d82e731d4e2cc9e10c2c0425a6afcd8
-
SHA512
aba1aced15e826b970b463e551882c13d5c22f6d848c527e577d1724a48ef0a8cd46969e74a4ca7826ddac605f1a1383fa900db8309a847107f312d347c62905
-
SSDEEP
3072:IBkaQl7LFc90cOMn8SKfbzxcwg7es6/Vsb8VKTup49oJMfF/H9N3Ky9NzLna:IYdc9LUhcX7elbKTuq9bfF/H9d9n
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
glass-coffee.gl.at.ply.gg:5417
Mutex
uvV9IoGdqsyWtzwq
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot7244696222:AAHqbV7Klrbtt5G5MocnpyydNFGt1mksjWg/sendMessage?chat_id=5854542114
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2260-1-0x0000000000BC0000-0x0000000000BF8000-memory.dmp family_xworm -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Onioncrack.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Onioncrack.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" Onioncrack.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2260 Onioncrack.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2260 Onioncrack.exe Token: SeDebugPrivilege 2260 Onioncrack.exe Token: SeDebugPrivilege 4332 taskmgr.exe Token: SeSystemProfilePrivilege 4332 taskmgr.exe Token: SeCreateGlobalPrivilege 4332 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe 4332 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2260 Onioncrack.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Onioncrack.exe"C:\Users\Admin\AppData\Local\Temp\Onioncrack.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2260
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4332