Analysis

  • max time kernel
    51s
  • max time network
    57s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-06-2024 17:14

General

  • Target

    Image_logger_beta_V2.0.exe

  • Size

    595KB

  • MD5

    c6764bd94862ab345c860ea174bf638c

  • SHA1

    62d799fc80275faa9084ea4b1d2dc981d7cf56c1

  • SHA256

    83cd09db1595a65a665e5b60a0d8bd718bbefb8a3139bf81f24589fc6028daea

  • SHA512

    98b4b4e5eb30209a50ea03db97aba3e70ab7f1f05082d699bc171db1ff79feb9e804f453409185d34f2d17171040749b0551c32f862872cfe40839e4df6ceb32

  • SSDEEP

    6144:kE+yclwQKjdn+WPtYVJIoBf7VHhWBTWrsHH8FElg1xxl/5eo:kBdlwHRn+WlYV+6R2aon8+lgbxl/Io

Score
10/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

modern-educators.gl.at.ply.gg:23695

Mutex

3YnM81doTROvxOJ9

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Image_logger_beta_V2.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Image_logger_beta_V2.0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\XImage logger beta.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\XImage logger beta.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\XImage logger beta.exe

    Filesize

    279KB

    MD5

    673ab7f6850b991878f1a7aafa7494bd

    SHA1

    8cc01935b97cc573511ebfec87a086cdd5f64f7b

    SHA256

    6cf09e890c04e4f3694906366436485b85d01106809cc12fa26107832d1dd8d7

    SHA512

    72709b065adbd257c9fa39ed614fe791c929cc4db1b73efd385ee037540c355c3ea4617595af131693941f49510b9acb0fe8ae460d5c345a7451f7e8484b6aa0

  • memory/2584-12-0x00007FF9FFBA3000-0x00007FF9FFBA5000-memory.dmp

    Filesize

    8KB

  • memory/2584-13-0x00000000002F0000-0x000000000033C000-memory.dmp

    Filesize

    304KB

  • memory/2584-18-0x00007FF9FFBA0000-0x00007FFA00661000-memory.dmp

    Filesize

    10.8MB

  • memory/2584-19-0x00007FF9FFBA3000-0x00007FF9FFBA5000-memory.dmp

    Filesize

    8KB

  • memory/2584-20-0x00007FF9FFBA0000-0x00007FFA00661000-memory.dmp

    Filesize

    10.8MB