Analysis
-
max time kernel
75s -
max time network
106s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
03-08-2024 19:24
Static task
static1
Behavioral task
behavioral1
Sample
Loader V2.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Loader V2.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Loader V2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Loader V2.exe
Resource
win11-20240802-en
General
-
Target
Loader V2.exe
-
Size
8.1MB
-
MD5
70a8a700260d1bf5d40214b4d16f2a4d
-
SHA1
888afda0f542f857c3627845abb17320c79348a3
-
SHA256
14430e71914c83f8d1de8e66caa39d07ab782efb662245fb9eff6aa9fca7ce87
-
SHA512
8d139e071d25106a30b3b00350fe08558bdaf884d039492611d90afd30c11ff08643560dc75ffaf7dafc0c53a96cf2b446239faf2fd8df9d0895d25b746d5d83
-
SSDEEP
196608:X7fP69w9dHnln76gtmUd74JVCbkQqeDDFloLRj/UVn5HIL6qG:Nvnln7RmUuJVuk0DDFWJCnVGs
Malware Config
Extracted
xworm
147.185.221.20:13908
147.185.221.16:60401
-
Install_directory
%AppData%
-
install_file
svhost.exe
-
telegram
https://api.telegram.org/bot7220907212:AAEOc5N7cpqGUVVvnWrzGHm8mdOrYN2e9mc/sendMessage?chat_id=6987872630
Extracted
44caliber
https://discord.com/api/webhooks/1267250103538810911/_8BMipnmgDV4n-Uu_YmzeHrxrFFQPSAoBBDlwlDVhsDsk_31uQMADxZw-pq563wCO5KV
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/536-341-0x0000000000DC0000-0x0000000000DCE000-memory.dmp disable_win_def -
Detect Xworm Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\injectdll.exe family_xworm behavioral2/memory/536-13-0x00000000006E0000-0x0000000000722000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\Temp\loaderr.exe family_xworm behavioral2/memory/3692-37-0x0000000000DF0000-0x0000000000E06000-memory.dmp family_xworm -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 700 powershell.exe 4184 powershell.exe 4756 powershell.exe 3504 powershell.exe -
Drops startup file 4 IoCs
Processes:
injectdll.exeloaderr.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk injectdll.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk injectdll.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk loaderr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk loaderr.exe -
Executes dropped EXE 8 IoCs
Processes:
Loader.exeinjectdll.exeloaderr.exefixer.exesvhost.exesvchost.exesvhost.exesvchost.exepid process 4384 Loader.exe 536 injectdll.exe 3692 loaderr.exe 2284 fixer.exe 4904 svhost.exe 2392 svchost.exe 4248 svhost.exe 2428 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
injectdll.exeloaderr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe" injectdll.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\svchost.exe" loaderr.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 freegeoip.app 2 freegeoip.app 7 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fixer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 fixer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier fixer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1356 schtasks.exe 3204 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
fixer.exepowershell.exeinjectdll.exepowershell.exepowershell.exepowershell.exeloaderr.exepid process 2284 fixer.exe 2284 fixer.exe 2284 fixer.exe 2284 fixer.exe 700 powershell.exe 700 powershell.exe 700 powershell.exe 536 injectdll.exe 4184 powershell.exe 4184 powershell.exe 4184 powershell.exe 4756 powershell.exe 4756 powershell.exe 4756 powershell.exe 3504 powershell.exe 3504 powershell.exe 3504 powershell.exe 3692 loaderr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
injectdll.exefixer.exeloaderr.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 536 injectdll.exe Token: SeDebugPrivilege 2284 fixer.exe Token: SeDebugPrivilege 3692 loaderr.exe Token: SeDebugPrivilege 700 powershell.exe Token: SeIncreaseQuotaPrivilege 700 powershell.exe Token: SeSecurityPrivilege 700 powershell.exe Token: SeTakeOwnershipPrivilege 700 powershell.exe Token: SeLoadDriverPrivilege 700 powershell.exe Token: SeSystemProfilePrivilege 700 powershell.exe Token: SeSystemtimePrivilege 700 powershell.exe Token: SeProfSingleProcessPrivilege 700 powershell.exe Token: SeIncBasePriorityPrivilege 700 powershell.exe Token: SeCreatePagefilePrivilege 700 powershell.exe Token: SeBackupPrivilege 700 powershell.exe Token: SeRestorePrivilege 700 powershell.exe Token: SeShutdownPrivilege 700 powershell.exe Token: SeDebugPrivilege 700 powershell.exe Token: SeSystemEnvironmentPrivilege 700 powershell.exe Token: SeRemoteShutdownPrivilege 700 powershell.exe Token: SeUndockPrivilege 700 powershell.exe Token: SeManageVolumePrivilege 700 powershell.exe Token: 33 700 powershell.exe Token: 34 700 powershell.exe Token: 35 700 powershell.exe Token: 36 700 powershell.exe Token: SeDebugPrivilege 536 injectdll.exe Token: SeDebugPrivilege 4184 powershell.exe Token: SeIncreaseQuotaPrivilege 4184 powershell.exe Token: SeSecurityPrivilege 4184 powershell.exe Token: SeTakeOwnershipPrivilege 4184 powershell.exe Token: SeLoadDriverPrivilege 4184 powershell.exe Token: SeSystemProfilePrivilege 4184 powershell.exe Token: SeSystemtimePrivilege 4184 powershell.exe Token: SeProfSingleProcessPrivilege 4184 powershell.exe Token: SeIncBasePriorityPrivilege 4184 powershell.exe Token: SeCreatePagefilePrivilege 4184 powershell.exe Token: SeBackupPrivilege 4184 powershell.exe Token: SeRestorePrivilege 4184 powershell.exe Token: SeShutdownPrivilege 4184 powershell.exe Token: SeDebugPrivilege 4184 powershell.exe Token: SeSystemEnvironmentPrivilege 4184 powershell.exe Token: SeRemoteShutdownPrivilege 4184 powershell.exe Token: SeUndockPrivilege 4184 powershell.exe Token: SeManageVolumePrivilege 4184 powershell.exe Token: 33 4184 powershell.exe Token: 34 4184 powershell.exe Token: 35 4184 powershell.exe Token: 36 4184 powershell.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeIncreaseQuotaPrivilege 4756 powershell.exe Token: SeSecurityPrivilege 4756 powershell.exe Token: SeTakeOwnershipPrivilege 4756 powershell.exe Token: SeLoadDriverPrivilege 4756 powershell.exe Token: SeSystemProfilePrivilege 4756 powershell.exe Token: SeSystemtimePrivilege 4756 powershell.exe Token: SeProfSingleProcessPrivilege 4756 powershell.exe Token: SeIncBasePriorityPrivilege 4756 powershell.exe Token: SeCreatePagefilePrivilege 4756 powershell.exe Token: SeBackupPrivilege 4756 powershell.exe Token: SeRestorePrivilege 4756 powershell.exe Token: SeShutdownPrivilege 4756 powershell.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeSystemEnvironmentPrivilege 4756 powershell.exe Token: SeRemoteShutdownPrivilege 4756 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
injectdll.exeloaderr.exepid process 536 injectdll.exe 3692 loaderr.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Loader V2.exeLoader.exeloaderr.exeinjectdll.exedescription pid process target process PID 500 wrote to memory of 4384 500 Loader V2.exe Loader.exe PID 500 wrote to memory of 4384 500 Loader V2.exe Loader.exe PID 500 wrote to memory of 536 500 Loader V2.exe injectdll.exe PID 500 wrote to memory of 536 500 Loader V2.exe injectdll.exe PID 4384 wrote to memory of 3692 4384 Loader.exe loaderr.exe PID 4384 wrote to memory of 3692 4384 Loader.exe loaderr.exe PID 4384 wrote to memory of 2284 4384 Loader.exe fixer.exe PID 4384 wrote to memory of 2284 4384 Loader.exe fixer.exe PID 3692 wrote to memory of 700 3692 loaderr.exe powershell.exe PID 3692 wrote to memory of 700 3692 loaderr.exe powershell.exe PID 536 wrote to memory of 1356 536 injectdll.exe schtasks.exe PID 536 wrote to memory of 1356 536 injectdll.exe schtasks.exe PID 3692 wrote to memory of 4184 3692 loaderr.exe powershell.exe PID 3692 wrote to memory of 4184 3692 loaderr.exe powershell.exe PID 3692 wrote to memory of 4756 3692 loaderr.exe powershell.exe PID 3692 wrote to memory of 4756 3692 loaderr.exe powershell.exe PID 3692 wrote to memory of 3504 3692 loaderr.exe powershell.exe PID 3692 wrote to memory of 3504 3692 loaderr.exe powershell.exe PID 3692 wrote to memory of 3204 3692 loaderr.exe schtasks.exe PID 3692 wrote to memory of 3204 3692 loaderr.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader V2.exe"C:\Users\Admin\AppData\Local\Temp\Loader V2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Users\Admin\AppData\Roaming\Loader.exe"C:\Users\Admin\AppData\Roaming\Loader.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\loaderr.exe"C:\Users\Admin\AppData\Local\Temp\loaderr.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loaderr.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'loaderr.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3504
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\svchost.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:3204
-
-
-
C:\Users\Admin\AppData\Local\Temp\fixer.exe"C:\Users\Admin\AppData\Local\Temp\fixer.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
-
C:\Users\Admin\AppData\Roaming\injectdll.exe"C:\Users\Admin\AppData\Roaming\injectdll.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1356
-
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:4904
-
C:\Users\Admin\AppData\Local\svchost.exeC:\Users\Admin\AppData\Local\svchost.exe1⤵
- Executes dropped EXE
PID:2392
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:4248
-
C:\Users\Admin\AppData\Local\svchost.exeC:\Users\Admin\AppData\Local\svchost.exe1⤵
- Executes dropped EXE
PID:2428
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
966B
MD5d79437374b44dfd4aac6eb6f39c112a0
SHA1043f320818da7e8e46ab27a14dab2b959f6fa481
SHA256d2befd1a7609a8728491779d2c6dcaeb81a86b23b7498cbb0cf9bcce5c2de7cf
SHA5125c5250759da35946d02768c67eb1f1a6aea5a92f0a4b9d797b26fd57b733c9d2783869665d63cf7294c0a0d9dd78299614aa747c8f9188ba09093b8306a6bda6
-
Filesize
1KB
MD5e22c51815c9183e71eef88cbb18bec73
SHA1f459249f8b683b54d9ea78240eadc438af2d5f40
SHA25617214dee431f30dfa969fdcdff1f2e2c10b2879bf6a1fa17ef9ddc3617322edc
SHA5129df11b00ffc342ec3ff307235f7d68cf6584898c56341486967dbae7e08dd8e0621a4bf649bad4330b97c8207554167bc1134e754208f586e9921f054ceffc38
-
Filesize
730B
MD5f1a3ff1b695f07dd41679f747b73f494
SHA147ce46765250586a7bc97612ef94dfca382d68a9
SHA256cdf80576827fa6f35b5a1277fa943d0770c49e60566af60c6641d5708e918903
SHA51212c2910e6594ac09a167b5182cc2e3a8d360cc5876ce416523f0998ba3962ce5453b6415efcd1465faa6fb01c0718e46f077393ec3864b07fd21cf6cadd693ac
-
Filesize
3KB
MD58592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
Filesize
654B
MD516c5fce5f7230eea11598ec11ed42862
SHA175392d4824706090f5e8907eee1059349c927600
SHA25687ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151
SHA512153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc
-
Filesize
1KB
MD53177abe17fc409f17fbec71b32575241
SHA113c8f081c43ceddb8fe0a1243d33d6c218a590c2
SHA25634d0156df3bc4df16e2a38746cbe7886efaa8a114e526928999a75db04aa1ff0
SHA51273fe86158ea7bcd2f952504f842e0e6075aafbff4e416c9c426ae31a59f87c61c16c7404c756520a04e76c79ee4529d11da1ac062317161ebc81be61bcb86247
-
Filesize
1KB
MD52bf668aa6b4a969ea5eeae597aaaa176
SHA1404233d36236b55a41f557675864ac527d0b9277
SHA25646b9b823435043d846ec3a0ab7c94dfdb2283068f5d1a8c602c78bf37653b8b2
SHA5126224d7ecb741541a10b30477690e7cb28eeb1da1807f810628727cd62262386af7ecbf33afca2a718d2230a1b33c7e1faa305a13d6740c64961a4e3880b9f040
-
Filesize
1KB
MD55a80ac54ac1a68b662837245fbb35186
SHA12e8b2cdb9637934bfa70ab67651ed6da01b63271
SHA2563632ba939989e3aea46e2d33d9e99c830bd2eebb68e719cf4749426f3f7b59e4
SHA512d4c789dad26797fc1c2a73faa0d9d77654b7b9315aa1e1eea8002ff51afdccf755a871f1c28dbf96cea3b2bcaef3f888366425fa186fd2652fe6fdf6c3e01b4a
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
274KB
MD588505913c2c75f796c9a021aab2d356d
SHA15b5c06998d3e200c21c77ea4efaeaecdc7344e78
SHA25662e414e990e80c8203955b0e32948ddc64903b80a462c339f1babfb03e641204
SHA5126fa46be04c2693ea164fe52ddf3cca0bdafd1ab34d8c0f1c2bf3d361c6042f45375343f59e9474ded6718f8177a4f7eb19fddccd95f7fbb87aad12358b2d6905
-
Filesize
65KB
MD595f8f28f5a8503461db6804cda9c4934
SHA181c0a30e498093d41948777135bbd407c7611cda
SHA256aa40b9b929868482be1daae474d7c93426cd049f844c956865709ff8b7f240c2
SHA5125c3460372a6640a98dd1b1d34a03b951ec4a8942e9065475e982a207881f290aedc3b51fe73c0da4c527e222addd1de2be7ba541e82287e43e16fc544ab34461
-
Filesize
7.6MB
MD5aa16f3774491b600121545a5f194cefc
SHA1c872fe765ecff1dada8378ad8a12cd5cf0425219
SHA256c0a2b824a0fd05854818bfb81b02bc6178db3f8519807b15d844580099428e1d
SHA5128b50e7c6eca25ecc2196fbfaf42079873e3c532a90e8d8b691fb594da3e067593f86f0d6488d0c314a27d78519f33fcbfb4532f811997891d55a47d582e1b3a8
-
Filesize
244KB
MD574ffb0d60d647dd6ad8d00c1bee48011
SHA14c8a707a33b35b78f374c66d59f9c2314c20b25f
SHA256b481f1e0cfe25e5f19da0a0333c78661bf5c75c0b1c616ff4aaaa07aed31efd1
SHA512fc667f4560d6b19a9a4f37eb0e66c751eb348ffc0db69c7d0bd733dfd2df2dfdadc7b780cd93686350444cc14a54283bafe3afec611bcac3ad0239eda659f46c