Overview

overview

10

Static

static

10

LLRImgLoggerV2.exe

windows10-2004-x64

10

Resubmissions

Analysis

  • max time kernel
    63s
  • max time network
    69s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 18:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LLRImgLoggerV2.exe

  • Size

    73KB

  • MD5

    0030cf5146201005b8c17fd76bdb7d2d

  • SHA1

    3e8321971e3c3341fd1d770a2830f118654737a4

  • SHA256

    cdb69e3d021f11dfc126b06b175fa1a888792fd23bc894aeee90bba53654915c

  • SHA512

    e2d51fcb7315ee36bba72b5ab1a9516248ce92aaf7f4263caefccddea7635816d631f3888ad9a2d309fd72a0508627a9be04d38b47260f865ef8946d7bb7c445

  • SSDEEP

    1536:4Vf82uCouEeXOaSjhIpdtMGcU6be7gYG3jATZKMl6qkMBUoOVzEehxIw:4VfBi3lX0MDU6be7VTwCkotOREe8w

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

promptylol-31420.portmap.io:31420

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    RuntimeBroker.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\LLRImgLoggerV2.exe
    "C:\Users\Admin\AppData\Local\Temp\LLRImgLoggerV2.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\LLRImgLoggerV2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'LLRImgLoggerV2.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4956
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2788
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2316
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4072
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2948
  • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
    C:\Users\Admin\AppData\Local\RuntimeBroker.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    bd5940f08d0be56e65e5f2aaf47c538e

    SHA1

    d7e31b87866e5e383ab5499da64aba50f03e8443

    SHA256

    2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

    SHA512

    c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    cc19bcff372d20459d3651ba8aef50e7

    SHA1

    3c6f1d4cdd647864fb97a16b1aefba67fcee11f7

    SHA256

    366473e774d8976c7fd4dc582220666fb61a4feb3f7c95e69b2a68ad9e446ec9

    SHA512

    a0e360ca4b6e874fd44612bf4b17f3722c0619da4f6bade12a62efadae88c2d33460114eaafa2bc3fb1cef5bea07e745b8bee24f15d0cacaff5f4a521b225080

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    15dde0683cd1ca19785d7262f554ba93

    SHA1

    d039c577e438546d10ac64837b05da480d06bf69

    SHA256

    d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

    SHA512

    57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

    Download Submit

  • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
    Filesize

    73KB

    MD5

    0030cf5146201005b8c17fd76bdb7d2d

    SHA1

    3e8321971e3c3341fd1d770a2830f118654737a4

    SHA256

    cdb69e3d021f11dfc126b06b175fa1a888792fd23bc894aeee90bba53654915c

    SHA512

    e2d51fcb7315ee36bba72b5ab1a9516248ce92aaf7f4263caefccddea7635816d631f3888ad9a2d309fd72a0508627a9be04d38b47260f865ef8946d7bb7c445

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0iwlbera.5jl.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk
    Filesize

    998B

    MD5

    224017ce519cdc7c3ad1bb04d5ff9ea8

    SHA1

    17b3a5d5df3c25fcf215e32508e796611ca5ba31

    SHA256

    ae094b6ba0d47cd2f6e4a99cc38333a5c96b6c39663ebd8d303d7daa01fc10e6

    SHA512

    cf13c4e4cfd9522cdbd8a1b62e5695b99c1f6619ec86c54b5091f7fa4c681f6a3d34cc08e2e0e72699d13da577c9f02e2510f87f34e645497e5c2aee99ac798d

    Download Submit

  • memory/1032-14-0x00007FF8B1F80000-0x00007FF8B2A41000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1032-8-0x0000028E7B4B0000-0x0000028E7B4D2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1032-15-0x00007FF8B1F80000-0x00007FF8B2A41000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1032-18-0x00007FF8B1F80000-0x00007FF8B2A41000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1032-13-0x00007FF8B1F80000-0x00007FF8B2A41000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2948-69-0x000001F3DE160000-0x000001F3DE161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2948-63-0x000001F3DE160000-0x000001F3DE161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2948-58-0x000001F3DE160000-0x000001F3DE161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2948-57-0x000001F3DE160000-0x000001F3DE161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2948-59-0x000001F3DE160000-0x000001F3DE161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2948-68-0x000001F3DE160000-0x000001F3DE161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2948-67-0x000001F3DE160000-0x000001F3DE161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2948-66-0x000001F3DE160000-0x000001F3DE161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2948-65-0x000001F3DE160000-0x000001F3DE161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2948-64-0x000001F3DE160000-0x000001F3DE161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3964-0-0x00007FF8B1F83000-0x00007FF8B1F85000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3964-2-0x00007FF8B1F80000-0x00007FF8B2A41000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3964-1-0x0000000000720000-0x0000000000738000-memory.dmp

    Filesize

    96KB

    Download

  • memory/3964-72-0x00007FF8B1F83000-0x00007FF8B1F85000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3964-73-0x00007FF8B1F80000-0x00007FF8B2A41000-memory.dmp

    Filesize

    10.8MB

    Download