Resubmissions
23/07/2024, 16:29
240723-tzcw9ayfrn 1023/07/2024, 16:26
240723-txm97s1hnf 1023/07/2024, 16:20
240723-ts2l2a1gjh 1023/07/2024, 16:15
240723-tqjnfa1fmc 1023/07/2024, 16:11
240723-tmz61s1ena 1023/07/2024, 15:54
240723-tclwms1blb 1023/07/2024, 15:48
240723-s8v9hsxfmr 1023/07/2024, 15:45
240723-s683lazhmg 1023/07/2024, 15:10
240723-skb6qsyhnf 1023/07/2024, 14:52
240723-r841zswapq 10Analysis
-
max time kernel
372s -
max time network
373s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 15:48
Behavioral task
behavioral1
Sample
писька чит.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
писька чит.exe
Resource
win10v2004-20240709-en
cobaltstrikexwormbackdoorbootkitdiscoveryevasionexecutionpersistenceprivilege_escalationratspywarestealertrojanupx
windows10-2004-x64
60 signatures
150 seconds
General
-
Target
писька чит.exe
-
Size
71KB
-
MD5
ed3794861ddc34b4748ff8081e80cb2b
-
SHA1
e63cf084552f0c2803de0109e3d2fcd3102c4738
-
SHA256
6af19a694c8c3e6860d2555ce16be115c599c3424ec1e01c0bf67acd3298ae0f
-
SHA512
df771b8eecb7e065628c06b8cca9aa7df6dd05bbdba0f85ed34010e264a286a17129289d6ac3e9f87c56152ed7a35302e88ae6643a1bb06c45745cf3d5ea0b03
-
SSDEEP
1536:EYB+O1NIBlJ4wlA0B4GI0b0xEPdB8QlOrIXt6fT+S1va+OuPyGV54:EOgQwlRB4wb0xEFBdMIk+S19OuaGV54
Malware Config
Extracted
Family
xworm
C2
main-although.gl.at.ply.gg:30970
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2636-1-0x0000000000C60000-0x0000000000C78000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2664 powershell.exe 2648 powershell.exe 1100 powershell.exe 2096 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk писька чит.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk писька чит.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2664 powershell.exe 2648 powershell.exe 1100 powershell.exe 2096 powershell.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 936 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2636 писька чит.exe Token: SeDebugPrivilege 2664 powershell.exe Token: SeDebugPrivilege 2648 powershell.exe Token: SeDebugPrivilege 1100 powershell.exe Token: SeDebugPrivilege 2096 powershell.exe Token: SeDebugPrivilege 2636 писька чит.exe Token: 33 1964 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1964 AUDIODG.EXE Token: 33 1964 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1964 AUDIODG.EXE Token: SeDebugPrivilege 936 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe 936 taskmgr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2664 2636 писька чит.exe 31 PID 2636 wrote to memory of 2664 2636 писька чит.exe 31 PID 2636 wrote to memory of 2664 2636 писька чит.exe 31 PID 2636 wrote to memory of 2648 2636 писька чит.exe 33 PID 2636 wrote to memory of 2648 2636 писька чит.exe 33 PID 2636 wrote to memory of 2648 2636 писька чит.exe 33 PID 2636 wrote to memory of 1100 2636 писька чит.exe 35 PID 2636 wrote to memory of 1100 2636 писька чит.exe 35 PID 2636 wrote to memory of 1100 2636 писька чит.exe 35 PID 2636 wrote to memory of 2096 2636 писька чит.exe 37 PID 2636 wrote to memory of 2096 2636 писька чит.exe 37 PID 2636 wrote to memory of 2096 2636 писька чит.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\писька чит.exe"C:\Users\Admin\AppData\Local\Temp\писька чит.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\писька чит.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'писька чит.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2336
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5ac1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5ad52fd11a933d18f850701db5587174f
SHA167da10786ea4892bba7e44997466eb8765ae6e0f
SHA25625ffa487ee74105c4be8daf26a17eb8a257bc07f707db56bd972ea6c1e8dd3dd
SHA512d34b01bd6eb5104f7f95febb9613a8ee9df0b8e0f75c0dead45c066ffb6f40ff0801834329cd013d95a54c258fe44d59936a619a7b36780f868f59ef9122b544