Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-06-2024 20:21

General

  • Target

    CHEATBLOXFRUIT.exe

  • Size

    68KB

  • MD5

    041b235f33b97454664759841a374573

  • SHA1

    1a05fc8c1f449566d3e30972fd9aaabc03dbc9d1

  • SHA256

    ab7e274e5bb0eaf7d46c8e3bce83c13a2e0c5a170c463c16c074a428ff562d12

  • SHA512

    36a8a6f41fbb74c63f4834c1d437a7a866da17645984671bd58194e6496113903888cd110b5608874801a133469707e14a3c0de356b380b086639befa8ae7a3b

  • SSDEEP

    1536:zJXF29ReOjinvSXVVFDyYJf9z6mkcdrpeO+uZgGk8:9XF29ReOjqGVljz6mkcdrpsm

Score
10/10

Malware Config

Extracted

Family

xworm

Version

3.0

C2

et-hansen.gl.at.ply.gg:33635

Mutex

prtv1Q5500cT7S76

Attributes
  • Install_directory

    %AppData%

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CHEATBLOXFRUIT.exe
    "C:\Users\Admin\AppData\Local\Temp\CHEATBLOXFRUIT.exe"
    1⤵
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    PID:4584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4584-0-0x00007FFBF81B3000-0x00007FFBF81B5000-memory.dmp

    Filesize

    8KB

  • memory/4584-1-0x0000000000890000-0x00000000008A6000-memory.dmp

    Filesize

    88KB

  • memory/4584-6-0x00007FFBF81B0000-0x00007FFBF8C71000-memory.dmp

    Filesize

    10.8MB

  • memory/4584-7-0x00007FFBF81B0000-0x00007FFBF8C71000-memory.dmp

    Filesize

    10.8MB