Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2024 14:38
Behavioral task
behavioral1
Sample
UNDERLIKERS.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
UNDERLIKERS.exe
-
Size
35KB
-
MD5
76b73a0a2856eb66ae9ecf691277b85c
-
SHA1
2658ecddb4da9c7668686c3f4e0acbd60c218f12
-
SHA256
5e17c292de5d7f2894155b1efa2ef3e438cec6a5d22f848c387336045a86f821
-
SHA512
5a0fe9cfae0784be77453cbec7e8ad3340cb62fe07b72f418767f7da6c930bf051ab357e922adc16834577d9bc7ee5b1a6b180886b403addc876c60e5e8bc58e
-
SSDEEP
768:bqHwqBDOYSlph2WI6LFyD9itLOjheyQk99dF:baORph26FO9idOjam
Malware Config
Extracted
Family
xworm
Version
3.0
C2
et-hansen.gl.at.ply.gg:33635
Mutex
82lKU2YueU4TDZ5Z
Attributes
-
Install_directory
%AppData%
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4876-1-0x0000000000650000-0x000000000065E000-memory.dmp family_xworm -
Drops startup file 2 IoCs
Processes:
UNDERLIKERS.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UNDERLIKERS.lnk UNDERLIKERS.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UNDERLIKERS.lnk UNDERLIKERS.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
UNDERLIKERS.exedescription pid process Token: SeDebugPrivilege 4876 UNDERLIKERS.exe Token: SeDebugPrivilege 4876 UNDERLIKERS.exe