Analysis
- max time kernel
42s - max time network
44s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
20/06/2024, 10:46
General
- Target DREAM ADVENCED v1.0 LOADER.exe
- Size 50KB
- Sample240620-mtzeqstaph
- SHA256 78fc041bb6cd457c95ea9c48d4c0f8cfff3fc1e536b2a4b95f8c0a831306d7a3
Malware Config
Extracted
-
xworm
-
install_file
wintousb.exe
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DREAM ADVENCED v1.0 LOADER.exe"C:\Users\Admin\AppData\Local\Temp\DREAM ADVENCED v1.0 LOADER.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uo4qxcwl\uo4qxcwl.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B2D.tmp" "c:\Users\Admin\AppData\Local\Temp\uo4qxcwl\CSC692F22984F5546CCADF0827F9EDB83E8.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RES6B2D.tmp
__PSScriptPolicyTest_i4kcong3.vfe.ps1
uo4qxcwl.dll
CSC692F22984F5546CCADF0827F9EDB83E8.TMP
uo4qxcwl.0.cs
uo4qxcwl.cmdline
memory/4988-26-0x000000001EA20000-0x000000001EA28000-memory.dmp
memory/4988-30-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp
memory/4988-4-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp
memory/4988-3-0x000000001C070000-0x000000001C0E6000-memory.dmp
memory/4988-2-0x0000000002F80000-0x0000000002FA2000-memory.dmp
memory/4988-1-0x0000000000E90000-0x0000000000EA2000-memory.dmp
memory/4988-0-0x00007FF8F2423000-0x00007FF8F2424000-memory.dmp
memory/4988-28-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp
memory/4988-29-0x000000001FA50000-0x000000001FA68000-memory.dmp
memory/4988-5-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp
memory/4988-31-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp
memory/4988-32-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp
memory/4988-33-0x00007FF8F2423000-0x00007FF8F2424000-memory.dmp
memory/4988-34-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp
memory/4988-35-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp
memory/4988-36-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp
memory/4988-37-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp
memory/4988-39-0x00007FF8F2420000-0x00007FF8F2E0C000-memory.dmp