Analysis

  • max time kernel
    275s
  • max time network
    284s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-06-2024 21:08

General

  • Target

    LabyMоd4.exe

  • Size

    560KB

  • MD5

    2ae96ec953ccf1e0334f53b423a0f9c5

  • SHA1

    ad213f9355f9eba4b1c93f9134d0cae98508c350

  • SHA256

    910351824ec9121d841b498baca5f57acc383f20e6ab755e5d353a9d281c4fb2

  • SHA512

    9dd0157e71086db20d54741ddd304ffc688d85ff01558c3660050a5471ec7c5933590e7fc79cf40147dc866fb3d3c3c7cacec6140ca2d1ff15313686850fb686

  • SSDEEP

    12288:B2rL+p6X35aAXuxGM7bGNMOddnSIXTHUhI:c735aZMzVjUS

Malware Config

Extracted

Family

xworm

C2

restaurant-equation.gl.at.ply.gg:23887

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LabyMоd4.exe
    "C:\Users\Admin\AppData\Local\Temp\LabyMоd4.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\labymod4-installer.jar"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3300
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:2120
    • C:\Users\Admin\AppData\Local\Temp\XClient.exe
      "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3892
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2064
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:452
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1180
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    4a41727d4931e3ac71ab3711d363bd95

    SHA1

    4f90bb826003142b78177cf16f8db0872f3e7a73

    SHA256

    b4c6bd84fb398a36620991434f82103c24519a06066e358cc096e969129283eb

    SHA512

    690d3c71865b0b0240b8151631b8a4874e23dbb461d5c88ef05717a4e2b8404e0571be51f6aca2aa543cc856b41f1684ec6c093079cf16fb9495408e9cbe53bf

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    ce4540390cc4841c8973eb5a3e9f4f7d

    SHA1

    2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

    SHA256

    e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

    SHA512

    2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    fd98baf5a9c30d41317663898985593b

    SHA1

    ea300b99f723d2429d75a6c40e0838bf60f17aad

    SHA256

    9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96

    SHA512

    bf4dbbd671b5d7afb326622a7c781f150860294d3dba7160330046c258c84a15981c70e50d84dc7faaa7cc8b8c90bf8df818b3f2d3806a8a3671dfe5e38fe7b0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    77d622bb1a5b250869a3238b9bc1402b

    SHA1

    d47f4003c2554b9dfc4c16f22460b331886b191b

    SHA256

    f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

    SHA512

    d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe

    Filesize

    190KB

    MD5

    f5cd88548481bd61561698c34fb5b94c

    SHA1

    26ccddacd3d767b5b495ab84db5aed5c1eca72bd

    SHA256

    8b721aab9de7fcd5eda8ad61eb2461b8ad4354142629f9589663874ff42f70ef

    SHA512

    295982830cd04b560c35bbdb6bdfc3a343aec8f7a8289c3650cfc1665e788b4aa877b0c8041ee035b2d6304e317623ca2dde52b5cdd5511b932de4a2150419e9

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_okn4zh1m.izw.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\labymod4-installer.jar

    Filesize

    341KB

    MD5

    65b10a02e94334034adb7251a1d521e2

    SHA1

    05b4bb293d461d0d2943b0b3209f4cc0afba35b2

    SHA256

    23ddcafd86f95231752b6f2ad7b9532c01c7043fb795ea4faaa3d09ba5ab35bb

    SHA512

    8fcc63df10dc17b9648945a81574a786bfa01db69e63e889dd18e0be0c60c0ee9d222b240d644982e759f79f139a9b573f9d0b03c025e558c15eaebb5fcc596d

  • memory/2064-77-0x000001CE779B0000-0x000001CE779D2000-memory.dmp

    Filesize

    136KB

  • memory/3300-19-0x000001E2E6410000-0x000001E2E6680000-memory.dmp

    Filesize

    2.4MB

  • memory/3300-41-0x000001E2E4C40000-0x000001E2E4C41000-memory.dmp

    Filesize

    4KB

  • memory/3300-39-0x000001E2E4C40000-0x000001E2E4C41000-memory.dmp

    Filesize

    4KB

  • memory/3300-120-0x000001E2E6410000-0x000001E2E6680000-memory.dmp

    Filesize

    2.4MB

  • memory/3892-20-0x00007FFE7DA83000-0x00007FFE7DA85000-memory.dmp

    Filesize

    8KB

  • memory/3892-63-0x00007FFE7DA80000-0x00007FFE7E541000-memory.dmp

    Filesize

    10.8MB

  • memory/3892-18-0x00000000006F0000-0x0000000000726000-memory.dmp

    Filesize

    216KB

  • memory/3892-123-0x00007FFE7DA80000-0x00007FFE7E541000-memory.dmp

    Filesize

    10.8MB