Overview

overview

10

Static

static

3

Loader.exe

windows10-2004-x64

10

Resubmissions

29-07-2024 08:54

240729-ktxvssvcpc 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader.exe

  • Size

    7.6MB

  • Sample

    240729-ktxvssvcpc

  • MD5

    aa16f3774491b600121545a5f194cefc

  • SHA1

    c872fe765ecff1dada8378ad8a12cd5cf0425219

  • SHA256

    c0a2b824a0fd05854818bfb81b02bc6178db3f8519807b15d844580099428e1d

  • SHA512

    8b50e7c6eca25ecc2196fbfaf42079873e3c532a90e8d8b691fb594da3e067593f86f0d6488d0c314a27d78519f33fcbfb4532f811997891d55a47d582e1b3a8

  • SSDEEP

    196608:8G46NbTO5uFqiXBIaqVCbB9+FsdH6HBiE555x:8G46N3O5uciXBvq09+wC/Hr

Score
10/10
44caliberxwormcredential_accessexecutionratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

147.185.221.16:60401

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    svchost.exe

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1267250103538810911/_8BMipnmgDV4n-Uu_YmzeHrxrFFQPSAoBBDlwlDVhsDsk_31uQMADxZw-pq563wCO5KV

Targets

    • Target

      Loader.exe

    • Size

      7.6MB

    • MD5

      aa16f3774491b600121545a5f194cefc

    • SHA1

      c872fe765ecff1dada8378ad8a12cd5cf0425219

    • SHA256

      c0a2b824a0fd05854818bfb81b02bc6178db3f8519807b15d844580099428e1d

    • SHA512

      8b50e7c6eca25ecc2196fbfaf42079873e3c532a90e8d8b691fb594da3e067593f86f0d6488d0c314a27d78519f33fcbfb4532f811997891d55a47d582e1b3a8

    • SSDEEP

      196608:8G46NbTO5uFqiXBIaqVCbB9+FsdH6HBiE555x:8G46N3O5uciXBvq09+wC/Hr

    Score
    10/10
    44caliberxwormcredential_accessexecutionratspywarestealertrojan

    • 44Caliber

      An open source infostealer written in C#.

      stealer44caliber

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks