Overview
overview
10Static
static
1026.06.2024...th.dll
windows10-1703-x64
326.06.2024...th.dll
windows7-x64
326.06.2024...th.dll
windows10-2004-x64
326.06.2024...th.dll
windows11-21h2-x64
326.06.2024/DxHax.exe
windows10-1703-x64
1026.06.2024/DxHax.exe
windows7-x64
1026.06.2024/DxHax.exe
windows10-2004-x64
1026.06.2024/DxHax.exe
windows11-21h2-x64
1026.06.2024...et.dll
windows10-1703-x64
126.06.2024...et.dll
windows7-x64
126.06.2024...et.dll
windows10-2004-x64
26.06.2024...et.dll
windows11-21h2-x64
126.06.2024...3b.exe
windows10-1703-x64
1026.06.2024...3b.exe
windows7-x64
1026.06.2024...3b.exe
windows10-2004-x64
1026.06.2024...3b.exe
windows11-21h2-x64
1026.06.2024...ll.cmd
windows10-1703-x64
126.06.2024...ll.cmd
windows7-x64
126.06.2024...ll.cmd
windows10-2004-x64
126.06.2024...ll.cmd
windows11-21h2-x64
1General
-
Target
DxHax - New.rar
-
Size
8.7MB
-
Sample
240803-bws5ysycqn
-
MD5
eca09d118c58bebd690a0a695e06f91a
-
SHA1
9aa33a20abdf460367b7090c767d16a08b81572a
-
SHA256
807365fb2ba6da0202b002ef59b76c7e5205cd7a20280b006403ca94ec700904
-
SHA512
10a80c3b36af11384ef44bbcf24a40a76e2105d1cd87423772bbf379f95329d294d62af417f6132c829b222ba1030d9f98522f75b88255c411eb0715ab5efa9f
-
SSDEEP
196608:3n0bCPxtPLjsRMeS90PrOd5pte4m9lyqstc/4en+:k+Px5LMMxsr8fte46RsRO+
Behavioral task
behavioral1
Sample
26.06.2024/DxHax.1.month.dll
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
26.06.2024/DxHax.1.month.dll
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
26.06.2024/DxHax.1.month.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
26.06.2024/DxHax.1.month.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
26.06.2024/DxHax.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
26.06.2024/DxHax.exe
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
26.06.2024/DxHax.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
26.06.2024/DxHax.exe
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
26.06.2024/System.Net.dll
Resource
win10-20240611-en
Behavioral task
behavioral10
Sample
26.06.2024/System.Net.dll
Resource
win7-20240705-en
Behavioral task
behavioral11
Sample
26.06.2024/System.Net.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
26.06.2024/System.Net.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
26.06.2024/ZGsg7Rz25btLV3b.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
26.06.2024/ZGsg7Rz25btLV3b.exe
Resource
win7-20240729-en
Behavioral task
behavioral15
Sample
26.06.2024/ZGsg7Rz25btLV3b.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
26.06.2024/ZGsg7Rz25btLV3b.exe
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
26.06.2024/uninstall.cmd
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
26.06.2024/uninstall.cmd
Resource
win7-20240729-en
Behavioral task
behavioral19
Sample
26.06.2024/uninstall.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
26.06.2024/uninstall.cmd
Resource
win11-20240802-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
85.105.15.233:5555
ivccsicmvcuaqdscj
-
delay
1
-
install
true
-
install_file
CTF Loader.exe
-
install_folder
%AppData%
Extracted
xworm
85.105.15.233:5555
-
Install_directory
%ProgramData%
-
install_file
USB.exe
Targets
-
-
Target
26.06.2024/DxHax.1.month.dll
-
Size
42KB
-
MD5
fd5791592f821f419276dc41041370f5
-
SHA1
529345646ace85659476f487b6c41eb3254edbb0
-
SHA256
db6b4ed4561e8730fda614ae1d213d5ba452353ac06f3c4bd1d896ea1668fa93
-
SHA512
5f92345c676438930b974c6a702e9129f1398477f28c9d320bf94b4626ec564066d32d287f2d28a2b8cdacb5d6d5722910c75b8bf4d59edfc6866242865551c6
-
SSDEEP
768:fegDSnBBghmExnQKwYh1uCEkbDLkYleUCIOqaKTsKGDcW:GgDSBBg0ExQKfhb3ST5KoKMc
Score3/10 -
-
-
Target
26.06.2024/DxHax.exe
-
Size
9.0MB
-
MD5
254e6ae77b775c805562a031bc0a1c65
-
SHA1
843d67a36aa8baf1033c931740f03dd9f77749e1
-
SHA256
caba4ef02b4c6c301d6ebee2833d23f59dbad37c2cfc8702a4cb31801fdb8284
-
SHA512
7807054101bff645a3dadd0d70061b812485128ec9eb8c12de0251b2fd65fb1e835006989138afdd8193b8208f912157047ae97416620900b2fb1fbbab819edd
-
SSDEEP
196608:XIHhCuQfOiZWD/ylAu96GZDd1GmtD0z1rDS/7eDvgrST:mhCuQOwAjGVXGmp0xr87J
-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Modify Registry: Disable Windows Driver Blocklist
Disable Windows Driver Blocklist via Registry.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
26.06.2024/System.Net.dll
-
Size
232KB
-
MD5
03ea41b17f2c043dc5d161eaab29d21c
-
SHA1
c404bf4b5b7d1b3610c6a8b11f23e95fea9204a8
-
SHA256
7c60d637c66956c06731a116e5ab825b6f4c9bc58b641230405bd482262dba97
-
SHA512
9d0feabef95b42d0ae0b31bd954ee217fc50a43316c15a7f8d7a13ddc35010f43553e95e3bd1b9c2fa50ba3e5ccfe2e70d7285435089a004f502dd684bfc61a2
-
SSDEEP
3072:u7ab0E4jbe6lwANv9gC/uJs4UZ/6irnCVLgHugGkm046mIDUAwJ5:z4jx/KTUZRDN5
Score1/10 -
-
-
Target
26.06.2024/ZGsg7Rz25btLV3b.exe
-
Size
132KB
-
MD5
e28df4004f9463f736761ccfb0afafe7
-
SHA1
9186f568819e064badced9200855707f73d5d52f
-
SHA256
3ad8a28960058545fb48b29ea57470086db2ef75c1006325b6871c8ea5fd81d2
-
SHA512
0e7aa2c42690a9ab4d15fff6aed63b4cbc86c2b2aafdeb2be1d5144f3273496d5dd9e70dc6d95815f59347168d5698553f5fe26fa87f1084604e97e19c4f891b
-
SSDEEP
1536:IUZgwcxiKrCfmPMVYuc0IeH1bF/P3piVQzcCBVclN:IUZ1cxiaUmPMVDccH1bFH32Q/rY
-
-
-
Target
26.06.2024/uninstall.cmd
-
Size
653B
-
MD5
fbc297ee9060d4256192e4edb98cad1b
-
SHA1
f305c065378aec46eb4dacaaeee3f866b1527105
-
SHA256
099592ffa867124d16c0c6d868af1214fd2b7180fa76e4eee01abf2a5cf8f044
-
SHA512
c867d366252e5124c6560fbb42ed4473dc7546360bc1221e9fcbc192e9216d6265e41ad26a733f7566c064b136ae02e21ef5f7095fcb6ae6f65b6fbeb3401ffe
Score1/10 -
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1