Analysis
-
max time kernel
18s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2024 21:09
Static task
static1
General
-
Target
XwormLoader.exe
-
Size
7.8MB
-
MD5
f194b7e7fdbfe0fbf70673937337dc05
-
SHA1
ca1fb45e83d267ce039a4639181b5f790f5b3241
-
SHA256
3e4cbe1810496aff2ef544d0aa0b5f8d1c69e2a4e86c21921348ede7a9db3967
-
SHA512
d63a5d2c84b42944820622fae2bc1cb681ea1e709b9972c35bfca28e198bc18f86f63718b62e50aafa59005df13f2d0f6edd017947133a2cd53688a7cd5844e2
-
SSDEEP
196608:W7b4C6XrL5HfZBEhl3xZi5OslC9+PWbXooVl41u1mMFsr5:W7yvRZBEP3xZi5Oso+PWbXooL4Sa
Malware Config
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\svchost.exe family_xworm behavioral1/memory/4368-16-0x00000000005F0000-0x000000000061A000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 3588 powershell.exe 2420 powershell.exe 3068 powershell.exe 2036 powershell.exe -
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\svchost.exe net_reactor behavioral1/memory/4368-16-0x00000000005F0000-0x000000000061A000-memory.dmp net_reactor -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
XwormLoader.exesvchost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation XwormLoader.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exeXworm V5.6.exepid process 4368 svchost.exe 4292 Xworm V5.6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2316 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
svchost.exepid process 4368 svchost.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exesvchost.exepid process 2420 powershell.exe 2420 powershell.exe 3068 powershell.exe 3068 powershell.exe 2036 powershell.exe 2036 powershell.exe 3588 powershell.exe 3588 powershell.exe 4368 svchost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
svchost.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4368 svchost.exe Token: SeDebugPrivilege 2420 powershell.exe Token: SeDebugPrivilege 3068 powershell.exe Token: SeDebugPrivilege 2036 powershell.exe Token: SeDebugPrivilege 3588 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 4368 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
XwormLoader.execmd.exesvchost.exedescription pid process target process PID 1576 wrote to memory of 4368 1576 XwormLoader.exe svchost.exe PID 1576 wrote to memory of 4368 1576 XwormLoader.exe svchost.exe PID 1576 wrote to memory of 4292 1576 XwormLoader.exe Xworm V5.6.exe PID 1576 wrote to memory of 4292 1576 XwormLoader.exe Xworm V5.6.exe PID 1576 wrote to memory of 3020 1576 XwormLoader.exe cmd.exe PID 1576 wrote to memory of 3020 1576 XwormLoader.exe cmd.exe PID 3020 wrote to memory of 2316 3020 cmd.exe timeout.exe PID 3020 wrote to memory of 2316 3020 cmd.exe timeout.exe PID 4368 wrote to memory of 2420 4368 svchost.exe powershell.exe PID 4368 wrote to memory of 2420 4368 svchost.exe powershell.exe PID 4368 wrote to memory of 3068 4368 svchost.exe powershell.exe PID 4368 wrote to memory of 3068 4368 svchost.exe powershell.exe PID 4368 wrote to memory of 2036 4368 svchost.exe powershell.exe PID 4368 wrote to memory of 2036 4368 svchost.exe powershell.exe PID 4368 wrote to memory of 3588 4368 svchost.exe powershell.exe PID 4368 wrote to memory of 3588 4368 svchost.exe powershell.exe PID 4368 wrote to memory of 3968 4368 svchost.exe schtasks.exe PID 4368 wrote to memory of 3968 4368 svchost.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3968
-
-
-
C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"2⤵
- Executes dropped EXE
PID:4292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4C0D.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2316
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5d079b2f414515e7536eab8def3f59752
SHA190cb03125d60dd194a44fe960df655d4a6268d10
SHA256f21e430cda6fdfc4fa1d51eadaea666e9e6aa92898fda11c9f3d54de02dee94a
SHA512022c5772b8203082037c7b4c433183f7593f126bc9138f512b5890211953fcd5d995bf05af905d0d597f5f84426dc072fa4964b5b76237856a18dc22bdec9eb9
-
Filesize
944B
MD5fe250435f89d0588c926e3ac356c5bde
SHA17c12ea4a4f280a4ab1878dcb0bd949c127cde11e
SHA256ad2e8837bb08c3e90100c9dc420fda2fa98d43d1c5908d9cb1d7ee7ee40e6371
SHA5128ab365fb4b2a5ffe58e5c606b69319962ae0d5ef0d8e831df8b68f569f64272a0ddce53863e82fc6e2e502a5ee617fdd8963bcd32b12de21ad5267d6fdcf173c
-
Filesize
14.9MB
MD5db51a102eab752762748a2dec8f7f67a
SHA1194688ec1511b83063f7b0167ae250764b7591d1
SHA25693e5e7f018053c445c521b010caff89e61f61743635db3500aad32d6e495abb2
SHA512fb2fb6605a17fedb65e636cf3716568e85b8ea423c23e0513eb87f3a3441e2cabc4c3e6346225a9bf7b81e97470f3ab516feea649a7afb5cdf02faff8d7f09a5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
144KB
MD54b90399888a12fb85ccc3d0190d5a1d3
SHA13326c027bac28b9480b0c7f621481a6cc033db4e
SHA256cede03d0ef98d200bd5b68f6ca4e0d74e2a62fc430a38083663c3031dbb1c77f
SHA512899ec2df2f5d70716ad5d0686bfe0a6c66ccbcf7f0485efbdfc0615f90b3526cd3d31069fa66c7c6ae8bba6ce92200836c50da40a3731888b7326b970d93216a
-
Filesize
163B
MD5c3b35356ee4f9893fe6d1dbbb9b9160f
SHA142c97e1ffaa782ba9d5cd44b3d25ce6796b10513
SHA2560fd0506609dbdec57a2e43eec26aba7e572193971d79e5398f3fb8094de14cf7
SHA512291d2c27597db3cb0ecb2514d59efbdace1841d83e36915e298153a37754431a14d2469aa9e963fed1471a209263ea545f3712e32a8ef0fd63511a19afd7dad9