Analysis

  • max time kernel
    42s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25-07-2024 13:08

Errors

Reason
Machine shutdown

General

  • Target

    AntiHacks.exe

  • Size

    3.2MB

  • MD5

    e0288245a40e10ff53abf8e72a92886b

  • SHA1

    e7c65a626687c6b3e2f72b9af6f3d4a037654fb9

  • SHA256

    e3f18a036f10a5bf7d92648a32f119bbdf79f3ad750532fcd2f70487a9783a19

  • SHA512

    56b7479c02371b318f3403a1715cf195a3f2fb7df66c718e9168943c79ec38d55252834138ef066f15eda3a62f9a7b2bceac855e5455d31380e11efc422f48ac

  • SSDEEP

    49152:6dsTqXFh3qCd825DyT8iHVmw6M2z0dcTaTfZb2fuYgZW83six0cJIjK3Uv+8sLFC:6d1dWAbkNcyZcuYgE4I258AXy

Malware Config

Extracted

Family

xworm

C2

main-although.gl.at.ply.gg:30970

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Disables Task Manager via registry modification
  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AntiHacks.exe
    "C:\Users\Admin\AppData\Local\Temp\AntiHacks.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\shellbag.exe
      "C:\Users\Admin\AppData\Local\Temp\shellbag.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2864
    • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\sVkY0feTF0k.vbe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\SurrogatewinDrivernetsvc\qbWCF1w5.bat" "
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2664
          • C:\SurrogatewinDrivernetsvc\portproviderperf.exe
            "C:\SurrogatewinDrivernetsvc\portproviderperf.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2712
          • C:\Windows\SysWOW64\reg.exe
            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2516
    • C:\Users\Admin\AppData\Local\Temp\checkinghackMinecraft.exe
      "C:\Users\Admin\AppData\Local\Temp\checkinghackMinecraft.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\checkinghackMinecraft.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2932
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'checkinghackMinecraft.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2024
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1956
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1576
      • C:\Windows\system32\shutdown.exe
        shutdown.exe /f /s /t 0
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2392
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:1504
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2440

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\SurrogatewinDrivernetsvc\qbWCF1w5.bat

        Filesize

        162B

        MD5

        e01ef91219b266b14d1ae415d30256d5

        SHA1

        cad006a2efee48fcad1166e7ce3bc118ff139808

        SHA256

        db58b3dde8508ecbe59d938545246355b52d9cdec29f76657b66638c4d7aeeb2

        SHA512

        7826ca4bda02431bff87c7c72bd1ea53bc769b8574302a37445318360326e5a89e309c35dbc8f9981ec35c5067b4a459195b78d0289f5d93f6ec54be4c3f1e7b

      • C:\SurrogatewinDrivernetsvc\sVkY0feTF0k.vbe

        Filesize

        209B

        MD5

        dff0ba210d60370a3210fbf77409987f

        SHA1

        dde49d39fcbd1fdef91262c3606dc428efb8edfa

        SHA256

        79720c3c313e1bdd57e0ddd8824ea9d0792b37388d0e7f06e9fddb07e63241ab

        SHA512

        a9a619f85ba84275a1dea2728201eeace31819a8654058e316edf701baa78370600719ad4100d6f7c3a505c88417730c968cf57a03b3b2b067979d9123f634a7

      • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe

        Filesize

        3.0MB

        MD5

        02a93a43adbbdfcdeb26c8103fe6696f

        SHA1

        3e1868a55003bc3e3e3f12194a9c79278dd82ffa

        SHA256

        826cd4f11e7de9cf540c894d23ba1164d14abe8df3fbb3edcf3b7052db1e45ee

        SHA512

        bfd5e591186fc35db75298954340f7c13c9a42d525641f5d953db0bd708abb6bf8fbe54ffe37bfd37ded72be63e2885b7544ae3b8126410864d78411bf025f0c

      • C:\Users\Admin\AppData\Local\Temp\checkinghackMinecraft.exe

        Filesize

        71KB

        MD5

        ed3794861ddc34b4748ff8081e80cb2b

        SHA1

        e63cf084552f0c2803de0109e3d2fcd3102c4738

        SHA256

        6af19a694c8c3e6860d2555ce16be115c599c3424ec1e01c0bf67acd3298ae0f

        SHA512

        df771b8eecb7e065628c06b8cca9aa7df6dd05bbdba0f85ed34010e264a286a17129289d6ac3e9f87c56152ed7a35302e88ae6643a1bb06c45745cf3d5ea0b03

      • C:\Users\Admin\AppData\Local\Temp\shellbag.exe

        Filesize

        1.6MB

        MD5

        463058236a0d84f8f8982d946eed0e07

        SHA1

        800ab71ed3b3bf4fb67fc9e1628e59d0aab8b124

        SHA256

        c93a0f4c6b5f24ee31cddb92b0ea3337021b5fb91faae8a381d3bd2c9b6add54

        SHA512

        18bd9aea8489c5e873a679da92c83d2739de9532f5751bd23aea9eda226b9a95909f8fd525b0ce47859492997002aee32ecf37bb79e07f24b512287b8fd58a53

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\913M2LIIBCK5O3FTDEHN.temp

        Filesize

        7KB

        MD5

        ffac412e35761679097e709adbd16c3c

        SHA1

        048ade6ca36c17a4e6a3a8597aefd7809e7b5788

        SHA256

        b99c939c431f1aa54b6e985dfd17629638f90f64a62710a983ada221374eeab4

        SHA512

        cd96ae90e22c2a2f8d6f87e0c39fcaf0a5d422c0b42f6c667240b3b0dc29f1cb6ec4d64289a9097a86be78ee7f9b3b861cc71ecbbe57d8b30f357403bae417a7

      • \SurrogatewinDrivernetsvc\portproviderperf.exe

        Filesize

        2.7MB

        MD5

        ccb3ede1b16f1040b8050978c107cd88

        SHA1

        0c5daee4db896be5f6e24076eba13d73958f35b0

        SHA256

        55013eeda207f51fa0e08e6c73193c56cc894c31e66dd08f8a7a085bad349fa0

        SHA512

        387c524522afdac4916fbb9c39e6dc137c922f27e534bd1cf1ec98bac357fc9c7add2de5ef70e5d6cdca0e1cbc9f7bd43b80cf9a9add6728234758e1e81f7e56

      • memory/1676-19-0x000007FEF54A0000-0x000007FEF5E8C000-memory.dmp

        Filesize

        9.9MB

      • memory/1676-0-0x000007FEF54A3000-0x000007FEF54A4000-memory.dmp

        Filesize

        4KB

      • memory/1676-1-0x000000013F9B0000-0x000000013FCEA000-memory.dmp

        Filesize

        3.2MB

      • memory/2024-51-0x0000000002890000-0x0000000002898000-memory.dmp

        Filesize

        32KB

      • memory/2024-50-0x000000001B690000-0x000000001B972000-memory.dmp

        Filesize

        2.9MB

      • memory/2712-37-0x0000000000980000-0x0000000000C36000-memory.dmp

        Filesize

        2.7MB

      • memory/2712-38-0x00000000004C0000-0x00000000004CE000-memory.dmp

        Filesize

        56KB

      • memory/2740-18-0x0000000001090000-0x00000000010A8000-memory.dmp

        Filesize

        96KB

      • memory/2864-23-0x0000000000400000-0x0000000000572000-memory.dmp

        Filesize

        1.4MB

      • memory/2864-22-0x0000000000400000-0x0000000000572000-memory.dmp

        Filesize

        1.4MB

      • memory/2864-20-0x0000000000409000-0x000000000040A000-memory.dmp

        Filesize

        4KB

      • memory/2864-67-0x0000000000400000-0x0000000000572000-memory.dmp

        Filesize

        1.4MB

      • memory/2864-71-0x0000000000400000-0x0000000000572000-memory.dmp

        Filesize

        1.4MB

      • memory/2932-43-0x000000001B690000-0x000000001B972000-memory.dmp

        Filesize

        2.9MB

      • memory/2932-44-0x0000000002860000-0x0000000002868000-memory.dmp

        Filesize

        32KB