Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10/07/2024, 09:26
General
-
Target
SecuriteInfo.com.TrojanX-gen.3121.exe
-
Size
552KB
-
MD5
6d4f51a238fce25887b0e3435fbf7fca
-
SHA1
6429f96ddf4737322799bee57dd42af539d4df77
-
SHA256
76ac8355a799b81b7adc8b3a3ee5f6f64f4cbd2ef23a421117346505da71a32c
-
SHA512
3d3d5d1d6057e4e31c0aca4413cb72d783cef910ad1a5eb1f3e52d25afef04e13a97883acecb058f962dc763f9589cd20df87d3efff50c242aeac4d4c0ea891e
-
SSDEEP
12288:/nMfWWNP0xC0eQVtJzJ0/jj4o7t8Xq3L8VRtoOsF:/MeWNPECratdJ84XXuUb90
Malware Config
Extracted
xworm
3.1
rwanco.duckdns.org:1515
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TrojanX-gen.3121.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TrojanX-gen.3121.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TrojanX-gen.3121.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TrojanX-gen.3121.exe"2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.TrojanX-gen.3121.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecuriteInfo.com.TrojanX-gen.3121.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.TrojanX-gen.3121.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
18KB
MD54b345dc60910036051f4818149b3126a
SHA14618c8468abc2e8a80f6f42c9213b0b1b0a7bd86
SHA25696e08c17e566b41012654d2080913193c990dc5629f690bbefae92261d2e3961
SHA512397f638b3fc7bf2972c5d22492b1ed5ec3e4b0047e52b91c968ed0256010e3e2448773d1fd22eda20a35bb9df2a6bb7386827b541085401e471c169c0bb1c76b
-
Filesize
18KB
MD5c2b9d0ad6cc41883df21ad63c49a1f90
SHA14e0dfcd7369c67a855574e293e464faa834a8a20
SHA2564dfa37ef83988e51f34c34fc74e930f327129417d5b563db2ac2aebf7e4d34e0
SHA512f88dea54c5de37be30e281217985920475bf993949765c3fa9d24520dbd5571802da2cc13b759bb04b27bdbd95ada9e66eaf7590ddc67351869b81713c211f38
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
40KB
-
Filesize
576KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
352KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
80KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
652KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
88KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB