Analysis
-
max time kernel
41s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2024 20:34
Behavioral task
behavioral1
Sample
XWormLоader 5.6 x64.exe
Resource
win10v2004-20240611-en
General
-
Target
XWormLоader 5.6 x64.exe
-
Size
62KB
-
MD5
e166dd45fd4a6d4e228f0a89fa3730c1
-
SHA1
98b15dc0ca3fde498d3ad1f53d542ee0b5024075
-
SHA256
60ddff3747cec6439d564d036b7a0f15ac22de87fe3d41dc3f6eca9292ca1cee
-
SHA512
beb7db6cb84ff8953d2892e710832b84d08cbc9daf68f0297ed169612fc30d9cc5ee9d7dda5a4cb4b19b407a34e94a26b117de0b7d4b831c348ff8a4715cd624
-
SSDEEP
1536:UjwsKswX1sd3vObCAaCN5C6qXOsQh6wm7:UkWk1e3mbCvMmOsQhI7
Malware Config
Extracted
xworm
feb-victorian.gl.at.ply.gg:12082
min-clusters.gl.at.ply.gg:12082
-
Install_directory
%AppData%
-
install_file
Antimalware Serrvice Executable.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4616-1-0x0000000000D80000-0x0000000000D96000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\Antimalware Serrvice Executable.exe family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 4724 powershell.exe 2248 powershell.exe 2892 powershell.exe 1928 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XWormLоader 5.6 x64.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation XWormLоader 5.6 x64.exe -
Drops startup file 2 IoCs
Processes:
XWormLоader 5.6 x64.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Serrvice Executable.lnk XWormLоader 5.6 x64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Serrvice Executable.lnk XWormLоader 5.6 x64.exe -
Executes dropped EXE 1 IoCs
Processes:
Antimalware Serrvice Executable.exepid process 1604 Antimalware Serrvice Executable.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
XWormLоader 5.6 x64.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antimalware Serrvice Executable = "C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Serrvice Executable.exe" XWormLоader 5.6 x64.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 29 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exetaskmgr.exepowershell.exepowershell.exepowershell.exeXWormLоader 5.6 x64.exepid process 4724 powershell.exe 4724 powershell.exe 3300 taskmgr.exe 3300 taskmgr.exe 2248 powershell.exe 2248 powershell.exe 2248 powershell.exe 3300 taskmgr.exe 3300 taskmgr.exe 2892 powershell.exe 2892 powershell.exe 3300 taskmgr.exe 1928 powershell.exe 1928 powershell.exe 3300 taskmgr.exe 4616 XWormLоader 5.6 x64.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
XWormLоader 5.6 x64.exepowershell.exetaskmgr.exepowershell.exepowershell.exepowershell.exeAntimalware Serrvice Executable.exedescription pid process Token: SeDebugPrivilege 4616 XWormLоader 5.6 x64.exe Token: SeDebugPrivilege 4724 powershell.exe Token: SeDebugPrivilege 3300 taskmgr.exe Token: SeSystemProfilePrivilege 3300 taskmgr.exe Token: SeCreateGlobalPrivilege 3300 taskmgr.exe Token: SeDebugPrivilege 2248 powershell.exe Token: SeDebugPrivilege 2892 powershell.exe Token: SeDebugPrivilege 1928 powershell.exe Token: SeDebugPrivilege 4616 XWormLоader 5.6 x64.exe Token: 33 3300 taskmgr.exe Token: SeIncBasePriorityPrivilege 3300 taskmgr.exe Token: SeDebugPrivilege 1604 Antimalware Serrvice Executable.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
Processes:
taskmgr.exepid process 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
Processes:
taskmgr.exepid process 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe 3300 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
XWormLоader 5.6 x64.exepid process 4616 XWormLоader 5.6 x64.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
XWormLоader 5.6 x64.exedescription pid process target process PID 4616 wrote to memory of 4724 4616 XWormLоader 5.6 x64.exe powershell.exe PID 4616 wrote to memory of 4724 4616 XWormLоader 5.6 x64.exe powershell.exe PID 4616 wrote to memory of 2248 4616 XWormLоader 5.6 x64.exe powershell.exe PID 4616 wrote to memory of 2248 4616 XWormLоader 5.6 x64.exe powershell.exe PID 4616 wrote to memory of 2892 4616 XWormLоader 5.6 x64.exe powershell.exe PID 4616 wrote to memory of 2892 4616 XWormLоader 5.6 x64.exe powershell.exe PID 4616 wrote to memory of 1928 4616 XWormLоader 5.6 x64.exe powershell.exe PID 4616 wrote to memory of 1928 4616 XWormLоader 5.6 x64.exe powershell.exe PID 4616 wrote to memory of 3304 4616 XWormLоader 5.6 x64.exe schtasks.exe PID 4616 wrote to memory of 3304 4616 XWormLоader 5.6 x64.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWormLоader 5.6 x64.exe"C:\Users\Admin\AppData\Local\Temp\XWormLоader 5.6 x64.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWormLоader 5.6 x64.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormLоader 5.6 x64.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Antimalware Serrvice Executable.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Antimalware Serrvice Executable.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Antimalware Serrvice Executable" /tr "C:\Users\Admin\AppData\Roaming\Antimalware Serrvice Executable.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:3304
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3300
-
C:\Users\Admin\AppData\Roaming\Antimalware Serrvice Executable.exe"C:\Users\Admin\AppData\Roaming\Antimalware Serrvice Executable.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1604
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD515dde0683cd1ca19785d7262f554ba93
SHA1d039c577e438546d10ac64837b05da480d06bf69
SHA256d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
SHA51257c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672
-
Filesize
944B
MD573d375b957e6a571723660974cc79bef
SHA1dde4d7c074f345a25610bc2d0f85dfe16ec9855c
SHA2569e10486480c7d54577b7290fc129284d7fcc435f93cbee4e07a9cabc681cb485
SHA512f2d4e3e50736889b721493bb458238f48ce05fc2e0ec4fae87983d26d9876abb7be53d9eac65a42c12a4cd88b1aec884f5a89f34b3f2ccdbe03ad383ce47b781
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
62KB
MD5e166dd45fd4a6d4e228f0a89fa3730c1
SHA198b15dc0ca3fde498d3ad1f53d542ee0b5024075
SHA25660ddff3747cec6439d564d036b7a0f15ac22de87fe3d41dc3f6eca9292ca1cee
SHA512beb7db6cb84ff8953d2892e710832b84d08cbc9daf68f0297ed169612fc30d9cc5ee9d7dda5a4cb4b19b407a34e94a26b117de0b7d4b831c348ff8a4715cd624
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Serrvice Executable.lnk
Filesize893B
MD5be947da1f0084c0ecbd18f9cc1d73d95
SHA1898fecf25ca7412661951b636df0acbfb4a52efb
SHA256257f8a7df9c264b35a2fef997cbe32787edd8cf1e3fa40675097fc04e3424450
SHA512e2182b67b4961e782d256bc8f51630f947916faa5e0d6532ac512eb5eb3f8e9c8962aa0c555c0373d1ec312dfb946724585425db828b8fb0aa5b1413ffad70c0