Analysis
- max time kernel
13s - max time network
15s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
08/06/2024, 09:45
General
- Target svchost.exe
- Size 389KB
- Sample240608-lrbefsbf68
- SHA256 d803f89ad1d23a5a569c85feed5974918ab7152dd2ba482401f0412c6cae8c78
Malware Config
Signatures
- Detect Xworm Payload 33 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- .NET Reactor proctector 34 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
svchost.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_dhd4kllj.ojs.ps1
memory/1636-365-0x00000000061E0000-0x0000000006534000-memory.dmp
memory/1636-367-0x0000000070700000-0x000000007074C000-memory.dmp
memory/2720-2-0x0000000005BF0000-0x0000000006194000-memory.dmp
memory/2720-3-0x0000000005710000-0x00000000057A2000-memory.dmp
memory/2720-5-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/2720-4-0x0000000005850000-0x00000000058EC000-memory.dmp
memory/2720-7-0x00000000056A0000-0x00000000056AA000-memory.dmp
memory/2720-78-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/2720-1-0x0000000000500000-0x0000000000568000-memory.dmp
memory/2720-0-0x00000000750BE000-0x00000000750BF000-memory.dmp
memory/3556-22-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-46-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-72-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-70-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-68-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-66-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-64-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-62-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-60-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-58-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-56-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-52-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-48-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-44-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-42-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-40-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-38-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-37-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-34-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-32-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-30-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-28-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-26-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-24-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-77-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/3556-20-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-18-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-16-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-14-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-12-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-50-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-74-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-307-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/3556-378-0x0000000006CD0000-0x0000000006CDA000-memory.dmp
memory/3556-8-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3556-54-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4996-340-0x0000000006EC0000-0x0000000006F63000-memory.dmp
memory/4996-309-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/4996-313-0x0000000004FB0000-0x0000000005016000-memory.dmp
memory/4996-314-0x0000000005020000-0x0000000005086000-memory.dmp
memory/4996-324-0x0000000005910000-0x0000000005C64000-memory.dmp
memory/4996-325-0x0000000005CD0000-0x0000000005CEE000-memory.dmp
memory/4996-326-0x0000000005D20000-0x0000000005D6C000-memory.dmp
memory/4996-327-0x00000000062A0000-0x00000000062D2000-memory.dmp
memory/4996-328-0x0000000070700000-0x000000007074C000-memory.dmp
memory/4996-339-0x0000000006E90000-0x0000000006EAE000-memory.dmp
memory/4996-338-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/4996-343-0x0000000007640000-0x0000000007CBA000-memory.dmp
memory/4996-312-0x0000000004D10000-0x0000000004D32000-memory.dmp
memory/4996-311-0x00000000052E0000-0x0000000005908000-memory.dmp
memory/4996-341-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/4996-344-0x0000000007000000-0x000000000701A000-memory.dmp
memory/4996-345-0x0000000007070000-0x000000000707A000-memory.dmp
memory/4996-346-0x0000000007280000-0x0000000007316000-memory.dmp
memory/4996-347-0x0000000007200000-0x0000000007211000-memory.dmp
memory/4996-348-0x0000000007230000-0x000000000723E000-memory.dmp
memory/4996-349-0x0000000007240000-0x0000000007254000-memory.dmp
memory/4996-350-0x0000000007340000-0x000000000735A000-memory.dmp
memory/4996-308-0x00000000023A0000-0x00000000023D6000-memory.dmp
memory/4996-310-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/4996-342-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/4996-351-0x0000000007320000-0x0000000007328000-memory.dmp
memory/4996-354-0x00000000750B0000-0x0000000075860000-memory.dmp