Overview

overview

10

Static

static

10

письк...т.exe

windows7-x64

10

письк...т.exe

windows10-2004-x64

Resubmissions

23/07/2024, 16:29

240723-tzcw9ayfrn 10

23/07/2024, 16:26

240723-txm97s1hnf 10

23/07/2024, 16:20

240723-ts2l2a1gjh 10

23/07/2024, 16:15

240723-tqjnfa1fmc 10

23/07/2024, 16:11

240723-tmz61s1ena 10

23/07/2024, 15:54

240723-tclwms1blb 10

23/07/2024, 15:48

240723-s8v9hsxfmr 10

23/07/2024, 15:45

240723-s683lazhmg 10

23/07/2024, 15:10

240723-skb6qsyhnf 10

23/07/2024, 14:52

240723-r841zswapq 10

Analysis

  • max time kernel
    101s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 15:10

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    писька чит.exe

  • Size

    71KB

  • MD5

    ed3794861ddc34b4748ff8081e80cb2b

  • SHA1

    e63cf084552f0c2803de0109e3d2fcd3102c4738

  • SHA256

    6af19a694c8c3e6860d2555ce16be115c599c3424ec1e01c0bf67acd3298ae0f

  • SHA512

    df771b8eecb7e065628c06b8cca9aa7df6dd05bbdba0f85ed34010e264a286a17129289d6ac3e9f87c56152ed7a35302e88ae6643a1bb06c45745cf3d5ea0b03

  • SSDEEP

    1536:EYB+O1NIBlJ4wlA0B4GI0b0xEPdB8QlOrIXt6fT+S1va+OuPyGV54:EOgQwlRB4wb0xEFBdMIk+S19OuaGV54

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Family

xworm

C2

main-although.gl.at.ply.gg:30970

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\писька чит.exe
    "C:\Users\Admin\AppData\Local\Temp\писька чит.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\писька чит.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1632
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'писька чит.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4408
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3748
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:396
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3828
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SDRSVC
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1448

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      77d622bb1a5b250869a3238b9bc1402b

      SHA1

      d47f4003c2554b9dfc4c16f22460b331886b191b

      SHA256

      f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

      SHA512

      d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      f41f42c322498af0591f396c59dd4304

      SHA1

      e1e5aa68d73d48bc5e743a34f6c0fa8960ff7514

      SHA256

      d8bd9a4a363ff2ac2dc887759ec6ba4215a4ce0925a8fb9c531573458ee4a31c

      SHA512

      2328a1b402b4fb0de9c451fb630eab58549129d3bcfb70b9834cfbd16065ebaadec006b309ea17ac182d34c53e01705cbc9e0196eb0cbd62600c866e79a1844f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      ce4540390cc4841c8973eb5a3e9f4f7d

      SHA1

      2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

      SHA256

      e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

      SHA512

      2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sw1svzay.kor.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
      Filesize

      771B

      MD5

      c7e9c28ec91033e43e526ca6b8236fa8

      SHA1

      4189d163b10d1a2d229386b394080a3f9789bba0

      SHA256

      cc26b45c97db0232455d5fdaf9ea4946a1befe4118b21e46f16c880c674c6f76

      SHA512

      2506ffe706bcdea7344b1df811650dbc65c9faafbc3690ceab538355ab8fc5ce347c3e1b2fc897f50bd6bdef2f881be4a50538019b08c1f09f53bc366f75f756

      Download Submit

    • C:\Users\Admin\AppData\Roaming\XClient.exe
      Filesize

      71KB

      MD5

      ed3794861ddc34b4748ff8081e80cb2b

      SHA1

      e63cf084552f0c2803de0109e3d2fcd3102c4738

      SHA256

      6af19a694c8c3e6860d2555ce16be115c599c3424ec1e01c0bf67acd3298ae0f

      SHA512

      df771b8eecb7e065628c06b8cca9aa7df6dd05bbdba0f85ed34010e264a286a17129289d6ac3e9f87c56152ed7a35302e88ae6643a1bb06c45745cf3d5ea0b03

      Download Submit

    • memory/556-0-0x00007FF968B43000-0x00007FF968B45000-memory.dmp

      Filesize

      8KB

      Download

    • memory/556-58-0x000000001CF90000-0x000000001CF9C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/556-59-0x00007FF968B40000-0x00007FF969601000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/556-57-0x00007FF968B43000-0x00007FF968B45000-memory.dmp

      Filesize

      8KB

      Download

    • memory/556-2-0x00007FF968B40000-0x00007FF969601000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/556-1-0x0000000000C10000-0x0000000000C28000-memory.dmp

      Filesize

      96KB

      Download

    • memory/1632-15-0x000001EEE4CC0000-0x000001EEE4CE2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/1632-18-0x00007FF968B40000-0x00007FF969601000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1632-5-0x00007FF968B40000-0x00007FF969601000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1632-3-0x00007FF968B40000-0x00007FF969601000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1632-4-0x00007FF968B40000-0x00007FF969601000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3828-60-0x00000263A78E0000-0x00000263A78E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3828-72-0x00000263A78E0000-0x00000263A78E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3828-71-0x00000263A78E0000-0x00000263A78E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3828-70-0x00000263A78E0000-0x00000263A78E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3828-69-0x00000263A78E0000-0x00000263A78E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3828-68-0x00000263A78E0000-0x00000263A78E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3828-67-0x00000263A78E0000-0x00000263A78E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3828-66-0x00000263A78E0000-0x00000263A78E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3828-61-0x00000263A78E0000-0x00000263A78E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3828-62-0x00000263A78E0000-0x00000263A78E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3828-82-0x00000263A53D0000-0x00000263A53E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3828-76-0x00000263A5370000-0x00000263A5380000-memory.dmp

      Filesize

      64KB

      Download