Analysis
- max time kernel
125s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
20/06/2024, 02:21
General
- Target cea76e9eeab26b41d8ccda3b9b4edd70606728e3ef0b6e1a8baa9777c1a89160.exe
- Size 718KB
- Sample240620-cs8a5stcne
- SHA256 cea76e9eeab26b41d8ccda3b9b4edd70606728e3ef0b6e1a8baa9777c1a89160
Malware Config
Extracted
-
xworm
-
5.0
-
107.175.101.198:7000
-
dvNrQCwanoQ9ouuD
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cea76e9eeab26b41d8ccda3b9b4edd70606728e3ef0b6e1a8baa9777c1a89160.exe"C:\Users\Admin\AppData\Local\Temp\cea76e9eeab26b41d8ccda3b9b4edd70606728e3ef0b6e1a8baa9777c1a89160.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wGNrtmXaCUDv.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wGNrtmXaCUDv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4939.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\cea76e9eeab26b41d8ccda3b9b4edd70606728e3ef0b6e1a8baa9777c1a89160.exe"C:\Users\Admin\AppData\Local\Temp\cea76e9eeab26b41d8ccda3b9b4edd70606728e3ef0b6e1a8baa9777c1a89160.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\cea76e9eeab26b41d8ccda3b9b4edd70606728e3ef0b6e1a8baa9777c1a89160.exe"C:\Users\Admin\AppData\Local\Temp\cea76e9eeab26b41d8ccda3b9b4edd70606728e3ef0b6e1a8baa9777c1a89160.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cea76e9eeab26b41d8ccda3b9b4edd70606728e3ef0b6e1a8baa9777c1a89160.exe.log
__PSScriptPolicyTest_vbwipamt.cp4.ps1
tmp4939.tmp
memory/1576-11-0x0000000008DD0000-0x0000000008E20000-memory.dmp
memory/1576-1-0x0000000000670000-0x0000000000728000-memory.dmp
memory/1576-5-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/1576-6-0x0000000006120000-0x000000000664C000-memory.dmp
memory/1576-7-0x0000000005460000-0x00000000054FC000-memory.dmp
memory/1576-8-0x0000000005420000-0x0000000005432000-memory.dmp
memory/1576-9-0x0000000008DA0000-0x0000000008DA8000-memory.dmp
memory/1576-10-0x0000000008DB0000-0x0000000008DBC000-memory.dmp
memory/1576-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp
memory/1576-16-0x0000000074D2E000-0x0000000074D2F000-memory.dmp
memory/1576-23-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/1576-2-0x0000000005640000-0x0000000005BE4000-memory.dmp
memory/1576-40-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/1576-4-0x00000000052D0000-0x00000000052DA000-memory.dmp
memory/1576-3-0x0000000005130000-0x00000000051C2000-memory.dmp
memory/3252-18-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/3252-44-0x0000000006EE0000-0x0000000006F12000-memory.dmp
memory/3252-68-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/3252-38-0x00000000059C0000-0x0000000005D14000-memory.dmp
memory/3252-25-0x00000000052C0000-0x0000000005326000-memory.dmp
memory/3252-20-0x0000000005390000-0x00000000059B8000-memory.dmp
memory/3252-21-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/3252-39-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/3252-24-0x00000000050A0000-0x0000000005106000-memory.dmp
memory/3252-17-0x0000000002610000-0x0000000002646000-memory.dmp
memory/3252-22-0x0000000004F80000-0x0000000004FA2000-memory.dmp
memory/3252-42-0x0000000005F30000-0x0000000005F4E000-memory.dmp
memory/3252-43-0x0000000005FF0000-0x000000000603C000-memory.dmp
memory/3252-65-0x0000000007590000-0x0000000007598000-memory.dmp
memory/3252-55-0x0000000006520000-0x000000000653E000-memory.dmp
memory/3252-45-0x00000000755B0000-0x00000000755FC000-memory.dmp
memory/3252-56-0x0000000006F30000-0x0000000006FD3000-memory.dmp
memory/3252-57-0x00000000078B0000-0x0000000007F2A000-memory.dmp
memory/3252-58-0x0000000007270000-0x000000000728A000-memory.dmp
memory/3252-59-0x00000000072E0000-0x00000000072EA000-memory.dmp
memory/3252-60-0x00000000074F0000-0x0000000007586000-memory.dmp
memory/3252-61-0x0000000007470000-0x0000000007481000-memory.dmp
memory/3252-62-0x00000000074A0000-0x00000000074AE000-memory.dmp
memory/3252-63-0x00000000074B0000-0x00000000074C4000-memory.dmp
memory/3252-64-0x00000000075B0000-0x00000000075CA000-memory.dmp
memory/3412-26-0x0000000000400000-0x000000000040E000-memory.dmp
memory/3412-41-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/3412-69-0x0000000074D20000-0x00000000754D0000-memory.dmp