Analysis

  • max time kernel
    90s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-06-2024 19:28

General

  • Target

    upx.exe

  • Size

    69KB

  • MD5

    a230d428e97911ce6959e1463d781257

  • SHA1

    0946c13059bf98fd3aacefd0b2681a42b95292cd

  • SHA256

    c8e088feb7de05c3852af588c1a440f61d06870a93b07a3c6b7e2c12c9d55b12

  • SHA512

    089f7f6e979729ba037a19510be160d1c407c712fa01614815ce2427ff6c8fe7fa80a2cb673a36611dc37734aba63f7c87832c3848ac9ce011343c0e15b7aa68

  • SSDEEP

    1536:KWEyI4XFyV0UUIRiZAkupj9bIu9uLhQSOIcoFqXgG:KWnIiyVxRiij9bIYYhdOBuqXz

Malware Config

Extracted

Family

xworm

C2

45.83.246.140:30120

Attributes
  • Install_directory

    %AppData%

  • install_file

    runtime.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\upx.exe
    "C:\Users\Admin\AppData\Local\Temp\upx.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2116-0-0x00007FFBAF1F3000-0x00007FFBAF1F5000-memory.dmp

    Filesize

    8KB

  • memory/2116-1-0x0000000000020000-0x0000000000038000-memory.dmp

    Filesize

    96KB

  • memory/2116-6-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

    Filesize

    10.8MB

  • memory/2116-7-0x00007FFBAF1F0000-0x00007FFBAFCB2000-memory.dmp

    Filesize

    10.8MB