Analysis
-
max time kernel
51s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2024 17:14
Static task
static1
General
-
Target
Image_logger_beta_V2.0.exe
-
Size
595KB
-
MD5
c6764bd94862ab345c860ea174bf638c
-
SHA1
62d799fc80275faa9084ea4b1d2dc981d7cf56c1
-
SHA256
83cd09db1595a65a665e5b60a0d8bd718bbefb8a3139bf81f24589fc6028daea
-
SHA512
98b4b4e5eb30209a50ea03db97aba3e70ab7f1f05082d699bc171db1ff79feb9e804f453409185d34f2d17171040749b0551c32f862872cfe40839e4df6ceb32
-
SSDEEP
6144:kE+yclwQKjdn+WPtYVJIoBf7VHhWBTWrsHH8FElg1xxl/5eo:kBdlwHRn+WlYV+6R2aon8+lgbxl/Io
Malware Config
Extracted
xworm
5.0
modern-educators.gl.at.ply.gg:23695
3YnM81doTROvxOJ9
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\RarSFX0\XImage logger beta.exe family_xworm behavioral1/memory/2584-13-0x00000000002F0000-0x000000000033C000-memory.dmp family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Image_logger_beta_V2.0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation Image_logger_beta_V2.0.exe -
Drops startup file 2 IoCs
Processes:
XImage logger beta.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XImage logger beta.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk XImage logger beta.exe -
Executes dropped EXE 1 IoCs
Processes:
XImage logger beta.exepid process 2584 XImage logger beta.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
XImage logger beta.exedescription pid process Token: SeDebugPrivilege 2584 XImage logger beta.exe Token: SeDebugPrivilege 2584 XImage logger beta.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Image_logger_beta_V2.0.exedescription pid process target process PID 4312 wrote to memory of 2584 4312 Image_logger_beta_V2.0.exe XImage logger beta.exe PID 4312 wrote to memory of 2584 4312 Image_logger_beta_V2.0.exe XImage logger beta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Image_logger_beta_V2.0.exe"C:\Users\Admin\AppData\Local\Temp\Image_logger_beta_V2.0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\XImage logger beta.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\XImage logger beta.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
279KB
MD5673ab7f6850b991878f1a7aafa7494bd
SHA18cc01935b97cc573511ebfec87a086cdd5f64f7b
SHA2566cf09e890c04e4f3694906366436485b85d01106809cc12fa26107832d1dd8d7
SHA51272709b065adbd257c9fa39ed614fe791c929cc4db1b73efd385ee037540c355c3ea4617595af131693941f49510b9acb0fe8ae460d5c345a7451f7e8484b6aa0