Overview

overview

10

Static

static

10

агу агу.exe

windows7-x64

10

агу агу.exe

windows10-1703-x64

10

агу агу.exe

windows10-2004-x64

10

агу агу.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    1695s
  • max time network
    1144s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-07-2024 19:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    агу агу.exe

  • Size

    66KB

  • MD5

    5c434aad5f00636f72eacd2629bd94d3

  • SHA1

    97d58aa930ca9033c03225f227643c0d3f363565

  • SHA256

    6fc07b159dc07440be552269b3744451ffb4de70d31cbb42ac26e153c02c57c2

  • SHA512

    aa193cc01233441f47e57b447b53fc337da9d93e4e4b012d2f298e0899e474e06ef678098cad6d31d47d4c208702d6a4953f34eb228fd71569d0e7f1959f87ac

  • SSDEEP

    1536:pumiy1u+SnmhVvUdp6S7rbxIsaM26/OkDBUs0:Dw+S6Od4YrbxI8OsBUx

Score
10/10
gurcuxwormexecutionpersistenceratstealertrojan

Malware Config

Extracted

Family

xworm

C2

positive-you.gl.at.ply.gg:16734

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7343225892:AAGJ-_TVGwSK_6PGyafbOWbFKwsijptXrto/sendMessage?chat_id=944774411

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7343225892:AAGJ-_TVGwSK_6PGyafbOWbFKwsijptXrto/sendMessage?chat_id=944774411

Signatures

  • Detect Xworm Payload 2 IoCs
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 43 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\агу агу.exe
    "C:\Users\Admin\AppData\Local\Temp\агу агу.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\агу агу.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'агу агу.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1216
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4408
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4560
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"
      2⤵
        PID:4952
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp727C.tmp.bat""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2880
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:940
    • C:\Users\Admin\AppData\Roaming\svchost
      C:\Users\Admin\AppData\Roaming\svchost
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2124
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3396
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2656
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5080

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      627073ee3ca9676911bee35548eff2b8

      SHA1

      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

      SHA256

      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

      SHA512

      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      1a9fa92a4f2e2ec9e244d43a6a4f8fb9

      SHA1

      9910190edfaccece1dfcc1d92e357772f5dae8f7

      SHA256

      0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

      SHA512

      5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      8cb7f4b4ab204cacd1af6b29c2a2042c

      SHA1

      244540c38e33eac05826d54282a0bfa60340d6a1

      SHA256

      4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

      SHA512

      7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      e1406e40bc90234838ab278843448a11

      SHA1

      7e056692cfcf53a92ba8582a5fc0d2a418ef0c81

      SHA256

      fdc53165753f599dd5a22b0bd229f8e4c63e73dc47aece0b475c79a7255b1d10

      SHA512

      8ada81e44b16bfca0141dfe52a0b63e3cc7827b8dc45bfea87f834ffb759eeac87426c722b75fd76a447ab5efb69e0053b9fb34bd42d40b413a48f702eb70ab7

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2G1O82FJ\www.bing[1].xml
      Filesize

      17KB

      MD5

      5cffc252c1298ea3316961dd95745891

      SHA1

      003982e446fb1850e9b6f9af77a13e463cffe547

      SHA256

      391a4cb702fd8b4c76cf834c52c2e8b0a179f33315fceaa62b149fe4233d4fd8

      SHA512

      fa4943d6a6f0f294741fa94de51386223207f4907972c4f755fb86977f0c4bb68a227fb95278fd111d6d151061880ddf474df627d33fd11a468df1df277a4235

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bxvv12iy.d5g.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp727C.tmp.bat
      Filesize

      165B

      MD5

      4a278875982491648c1b91de2eae4437

      SHA1

      0328a9d6385fc25aa7c8f70bd241421f3e913729

      SHA256

      9a8ef9120e8825004a5d5f1bb7c08007aea5fa7b3799ac198e27f140a254f215

      SHA512

      279dcb6779f55778a01d938fbc2984c8af172591a7f809f8d3fddc3a0bf2475a084f7c7613049d47801fdf020e4c727309e4c8ff5fdf65e556b469a529a4a772

      Download Submit

    • C:\Users\Admin\AppData\Roaming\svchost
      Filesize

      66KB

      MD5

      5c434aad5f00636f72eacd2629bd94d3

      SHA1

      97d58aa930ca9033c03225f227643c0d3f363565

      SHA256

      6fc07b159dc07440be552269b3744451ffb4de70d31cbb42ac26e153c02c57c2

      SHA512

      aa193cc01233441f47e57b447b53fc337da9d93e4e4b012d2f298e0899e474e06ef678098cad6d31d47d4c208702d6a4953f34eb228fd71569d0e7f1959f87ac

      Download Submit

    • memory/2656-249-0x00000258D1C00000-0x00000258D1D00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2656-166-0x00000258CDB20000-0x00000258CDB40000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2656-165-0x00000258CDBC0000-0x00000258CDBE0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2656-164-0x00000258CDBE0000-0x00000258CDCE0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2656-139-0x00000258BBDA0000-0x00000258BBDC0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2656-107-0x000002589A210000-0x000002589A310000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2656-74-0x000002589A210000-0x000002589A310000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2808-12-0x00007FFAE7B70000-0x00007FFAE8632000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2808-8-0x0000024A270A0000-0x0000024A270C2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2808-14-0x00007FFAE7B70000-0x00007FFAE8632000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2808-13-0x00007FFAE7B70000-0x00007FFAE8632000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2808-19-0x00007FFAE7B70000-0x00007FFAE8632000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2808-18-0x00007FFAE7B70000-0x00007FFAE8632000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2808-15-0x00007FFAE7B70000-0x00007FFAE8632000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4712-55-0x00007FFAE7B70000-0x00007FFAE8632000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4712-59-0x00007FFAE7B70000-0x00007FFAE8632000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4712-0-0x0000000000690000-0x00000000006A6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/4712-2-0x00007FFAE7B70000-0x00007FFAE8632000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4712-1-0x00007FFAE7B73000-0x00007FFAE7B75000-memory.dmp

      Filesize

      8KB

      Download