Analysis
- max time kernel
292s - max time network
311s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
09/06/2024, 15:50
General
- Target xylex.exe
- Size 70KB
- Sample240609-taepjscg88
- SHA256 2d66f5076e6e2fdb521ce886a78fb2c29c8fa1392ad10265e78dc033b50afc91
Malware Config
Extracted
-
xworm
-
medical-m.gl.at.ply.gg:28857
-
Install_directory
%ProgramData%
-
install_file
conhost.exe
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload 2 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Modifies Installed Components in the registry 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- System policy modification 1 TTPs 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\xylex.exe"C:\Users\Admin\AppData\Local\Temp\xylex.exe"1⤵
- UAC bypass
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xylex.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'xylex.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\conhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'conhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "conhost" /tr "C:\ProgramData\conhost.exe"2⤵
- Creates scheduled task(s)
-
-
C:\ProgramData\conhost.exeC:\ProgramData\conhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\xylex.exe"C:\Users\Admin\AppData\Local\Temp\xylex.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\xylex.exe"C:\Users\Admin\AppData\Local\Temp\xylex.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\conhost.exeC:\ProgramData\conhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\conhost.exeC:\ProgramData\conhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\conhost.exeC:\ProgramData\conhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\ProgramData\conhost.exeC:\ProgramData\conhost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
conhost.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
conhost.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
microsoft.windows[1].xml
__PSScriptPolicyTest_thwlr5v2.krs.ps1
memory/748-91-0x000000001CA60000-0x000000001CA72000-memory.dmp
memory/748-0-0x00007FFEE9C43000-0x00007FFEE9C45000-memory.dmp
memory/748-1-0x0000000000CB0000-0x0000000000CC8000-memory.dmp
memory/748-57-0x00007FFEE9C43000-0x00007FFEE9C45000-memory.dmp
memory/748-58-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
memory/748-2-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
memory/748-92-0x000000001CB70000-0x000000001CB7A000-memory.dmp
memory/748-85-0x0000000001350000-0x000000000135C000-memory.dmp
memory/748-87-0x000000001CF70000-0x000000001CF7E000-memory.dmp
memory/748-88-0x000000001D220000-0x000000001D22A000-memory.dmp
memory/748-89-0x000000001D230000-0x000000001D23A000-memory.dmp
memory/748-90-0x000000001CC80000-0x000000001CC92000-memory.dmp
memory/1696-394-0x00000231CA370000-0x00000231CA470000-memory.dmp
memory/1696-395-0x00000231CA370000-0x00000231CA470000-memory.dmp
memory/1696-431-0x00000231CB8A0000-0x00000231CB8C0000-memory.dmp
memory/1696-411-0x00000231CB290000-0x00000231CB2B0000-memory.dmp
memory/1696-399-0x00000231CB2D0000-0x00000231CB2F0000-memory.dmp
memory/2064-101-0x0000000002960000-0x0000000002961000-memory.dmp
memory/2956-120-0x0000026587A00000-0x0000026587A20000-memory.dmp
memory/2956-108-0x0000026587A40000-0x0000026587A60000-memory.dmp
memory/2956-132-0x0000026587E10000-0x0000026587E30000-memory.dmp
memory/3152-541-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/3572-248-0x00000000036B0000-0x00000000036B1000-memory.dmp
memory/4176-393-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/4568-762-0x00000203D1A40000-0x00000203D1A60000-memory.dmp
memory/4568-560-0x00000203BE370000-0x00000203BE390000-memory.dmp
memory/4568-549-0x00000203BE3B0000-0x00000203BE3D0000-memory.dmp
memory/4856-14-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
memory/4856-18-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
memory/4856-12-0x000001E7FFF70000-0x000001E7FFF92000-memory.dmp
memory/4856-13-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
memory/4856-15-0x00007FFEE9C40000-0x00007FFEEA701000-memory.dmp
memory/4876-277-0x00000237D88E0000-0x00000237D8900000-memory.dmp
memory/4876-265-0x00000237D82D0000-0x00000237D82F0000-memory.dmp
memory/4876-255-0x00000237D8310000-0x00000237D8330000-memory.dmp
memory/4876-250-0x00000237D7400000-0x00000237D7500000-memory.dmp
memory/4876-251-0x00000237D7400000-0x00000237D7500000-memory.dmp