Overview

overview

10

Static

static

10

письк...т.exe

windows7-x64

10

письк...т.exe

windows10-2004-x64

10

Resubmissions

23/07/2024, 16:29

240723-tzcw9ayfrn 10

23/07/2024, 16:26

240723-txm97s1hnf 10

23/07/2024, 16:20

240723-ts2l2a1gjh 10

23/07/2024, 16:15

240723-tqjnfa1fmc 10

23/07/2024, 16:11

240723-tmz61s1ena 10

23/07/2024, 15:54

240723-tclwms1blb 10

23/07/2024, 15:48

240723-s8v9hsxfmr 10

23/07/2024, 15:45

240723-s683lazhmg 10

23/07/2024, 15:10

240723-skb6qsyhnf 10

23/07/2024, 14:52

240723-r841zswapq 10

Analysis

  • max time kernel
    226s
  • max time network
    225s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 16:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    писька чит.exe

  • Size

    71KB

  • MD5

    ed3794861ddc34b4748ff8081e80cb2b

  • SHA1

    e63cf084552f0c2803de0109e3d2fcd3102c4738

  • SHA256

    6af19a694c8c3e6860d2555ce16be115c599c3424ec1e01c0bf67acd3298ae0f

  • SHA512

    df771b8eecb7e065628c06b8cca9aa7df6dd05bbdba0f85ed34010e264a286a17129289d6ac3e9f87c56152ed7a35302e88ae6643a1bb06c45745cf3d5ea0b03

  • SSDEEP

    1536:EYB+O1NIBlJ4wlA0B4GI0b0xEPdB8QlOrIXt6fT+S1va+OuPyGV54:EOgQwlRB4wb0xEFBdMIk+S19OuaGV54

Score
10/10
xwormdiscoveryexecutionrattrojanupx

Malware Config

Extracted

Family

xworm

C2

main-although.gl.at.ply.gg:30970

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\писька чит.exe
    "C:\Users\Admin\AppData\Local\Temp\писька чит.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\писька чит.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4364
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'писька чит.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1672
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:408
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4272
    • C:\Users\Admin\AppData\Local\Temp\mswbwe.exe
      "C:\Users\Admin\AppData\Local\Temp\mswbwe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Windows\system32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6A4E.tmp\6A4F.tmp\6A50.bat C:\Users\Admin\AppData\Local\Temp\mswbwe.exe"
        3⤵
        • Checks computer location settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4032
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\6.VBS"
          4⤵
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:2720
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1000
    • C:\Users\Admin\AppData\Local\Temp\писька чит.exe
      "C:\Users\Admin\AppData\Local\Temp\писька чит.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5112
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2172
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x150 0x2f8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4820
    • C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /s
      1⤵
      • Drops file in System32 directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4988
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ImportRequest.avi"
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3900

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
      Filesize

      9KB

      MD5

      7050d5ae8acfbe560fa11073fef8185d

      SHA1

      5bc38e77ff06785fe0aec5a345c4ccd15752560e

      SHA256

      cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

      SHA512

      a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      6d3e9c29fe44e90aae6ed30ccf799ca8

      SHA1

      c7974ef72264bbdf13a2793ccf1aed11bc565dce

      SHA256

      2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

      SHA512

      60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      10890cda4b6eab618e926c4118ab0647

      SHA1

      1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

      SHA256

      00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

      SHA512

      a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      eb1ad317bd25b55b2bbdce8a28a74a94

      SHA1

      98a3978be4d10d62e7411946474579ee5bdc5ea6

      SHA256

      9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

      SHA512

      d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\6A4E.tmp\6A4F.tmp\6A50.bat
      Filesize

      27B

      MD5

      c7da66cab92e95daf435dc74fa5ca35a

      SHA1

      924f2b0ebac4eac12c78b298697400a1b338a4c5

      SHA256

      4ab885b4b48037707771cc63658513d3d82a80cf97fbcdf4558e35bc3adc2b92

      SHA512

      28737deed8241b3c577cc6a2942287d5be0f9a45f9a902696ab733c78fe2bcd0d47d29d0efec6cca57de656472346170379c7d1ba60a5508c31f883674786787

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fyaix0xq.za2.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\mswbwe.exe
      Filesize

      237KB

      MD5

      6520885628fe337b8665099479cc1d4d

      SHA1

      09741f5c74b3525c31004c5bd19b0ecab835186d

      SHA256

      13d8121844734f49d93956b30ffab57a220e5fe1345a0bcf89e4df9cd37ab4f4

      SHA512

      235d7a2cd8751c7f128d6e6014f098f296d49bf1fca6e0c716e3330588f9ab0688a25ab44b02879411b6210f3febdfed35d9beb1ef5a18542578211fbdd9fe9c

      Download Submit

    • C:\Users\Admin\AppData\Roaming\6.VBS
      Filesize

      115B

      MD5

      9e242f8f35222db7713bf96248c7434c

      SHA1

      a66a0c27eca4aa325bc3dc8d907837180bcbd1b3

      SHA256

      5d173c4f51d33ea28ce3a5aa715bc7140f7bcc82c4b99fad2a2d3474c476c731

      SHA512

      4c4383df59bbbe7d5d86bc0f78b44afc68327789f5244f7cdf55f81889b6e74d008d0b94e6dfec66ac8394699919bc75a038b6c9c380fbe83161ad702b830b56

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
      Filesize

      771B

      MD5

      b523f519b256b70b3d825a4268e3f2f0

      SHA1

      d13124955a3823762960a9657ecfe8ff75b1401b

      SHA256

      a7dc69cf757f71def2343335f0f8ae0e6761885c38607d311b3d5062e39e9754

      SHA512

      898e204e5058a88312f5ff5669923f7bb3dc82c4da28d4485fd899e27ead97862984af77ee3b69967c98d7a5f2f2e6aa64b04dcf669238519c02ce3ef9d166ff

      Download Submit

    • C:\Users\Admin\AppData\Roaming\XClient.exe
      Filesize

      71KB

      MD5

      ed3794861ddc34b4748ff8081e80cb2b

      SHA1

      e63cf084552f0c2803de0109e3d2fcd3102c4738

      SHA256

      6af19a694c8c3e6860d2555ce16be115c599c3424ec1e01c0bf67acd3298ae0f

      SHA512

      df771b8eecb7e065628c06b8cca9aa7df6dd05bbdba0f85ed34010e264a286a17129289d6ac3e9f87c56152ed7a35302e88ae6643a1bb06c45745cf3d5ea0b03

      Download Submit

    • C:\Users\Admin\AppData\Roaming\piz.mp3
      Filesize

      198KB

      MD5

      71cf668f8ebbceda772022165b460ce3

      SHA1

      99febb0f4f9f388a4f9aeedd1530b50e0790500c

      SHA256

      321f25cb7284f1b11bea1dd0286efcce180a2ea15357acca7158d575840c3033

      SHA512

      bbc77a20f1a0a5355e82a40741ed50cc27fbbe97b4615c9f47644288275710ea288504fb97d14f786192bd6db54ba06ed61a3210a3571d988d026293aeb17a63

      Download Submit

    • memory/2172-66-0x00000292B7EA0000-0x00000292B7EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2172-70-0x00000292B7EA0000-0x00000292B7EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2172-67-0x00000292B7EA0000-0x00000292B7EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2172-60-0x00000292B7EA0000-0x00000292B7EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2172-61-0x00000292B7EA0000-0x00000292B7EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2172-62-0x00000292B7EA0000-0x00000292B7EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2172-68-0x00000292B7EA0000-0x00000292B7EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2172-72-0x00000292B7EA0000-0x00000292B7EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2172-71-0x00000292B7EA0000-0x00000292B7EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2172-69-0x00000292B7EA0000-0x00000292B7EA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3900-126-0x00007FFD37920000-0x00007FFD389D0000-memory.dmp

      Filesize

      16.7MB

      Download

    • memory/3900-125-0x00007FFD3DE70000-0x00007FFD3E126000-memory.dmp

      Filesize

      2.7MB

      Download

    • memory/3900-124-0x00007FFD552F0000-0x00007FFD55324000-memory.dmp

      Filesize

      208KB

      Download

    • memory/3900-123-0x00007FF7D3BA0000-0x00007FF7D3C98000-memory.dmp

      Filesize

      992KB

      Download

    • memory/4308-2-0x00007FFD45420000-0x00007FFD45EE1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4308-0-0x00007FFD45423000-0x00007FFD45425000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4308-58-0x00007FFD45420000-0x00007FFD45EE1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4308-57-0x00007FFD45423000-0x00007FFD45425000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4308-75-0x00000000021F0000-0x00000000021FC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/4308-1-0x0000000000260000-0x0000000000278000-memory.dmp

      Filesize

      96KB

      Download

    • memory/4364-18-0x00007FFD45420000-0x00007FFD45EE1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4364-3-0x00007FFD45420000-0x00007FFD45EE1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4364-4-0x00007FFD45420000-0x00007FFD45EE1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4364-5-0x00007FFD45420000-0x00007FFD45EE1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4364-11-0x000001607E620000-0x000001607E642000-memory.dmp

      Filesize

      136KB

      Download

    • memory/5012-105-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/5012-84-0x0000000000400000-0x000000000044D000-memory.dmp

      Filesize

      308KB

      Download