Overview

overview

10

Static

static

10

Cleaner.exe

windows7-x64

10

Cleaner.exe

windows10-2004-x64

10

Resubmissions

07-08-2024 21:46

240807-1m3qgayapb 10

07-08-2024 21:41

240807-1jzveavbnj 10

Analysis

  • max time kernel
    146s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07-08-2024 21:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Cleaner.exe

  • Size

    172KB

  • MD5

    9229077d00bad648e91aaf30bd096567

  • SHA1

    83eba361175f6c5dd71f740d527ab853a504d15b

  • SHA256

    1eca23db92c0319d414040c2ff9a240d57f806290e1f0238d696fea761c5d948

  • SHA512

    a8d6ac08eb8a2d74791238bfd73cda0062ac4a706bba6a61472efd4a062e2e611661a931d0d14a7edd52a833be830c254dbc14b184ae30a013687d547bc105a7

  • SSDEEP

    3072:IuAN13vRxKBL+b0kb1zehFjO/G16Bz65/M6If+3Js+3JFkKeTnZ:KRYib0y1ihf16xBt25

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:1990

Attributes
  • Install_directory

    %AppData%

  • install_file

    cleaner.exe

Signatures

  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 13 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\Cleaner.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2480
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "cleaner" /tr "C:\Users\Admin\AppData\Roaming\cleaner.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2796
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2840
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Log.tmp
      1⤵
      • Modifies registry class
      PID:628
    • C:\Users\Admin\AppData\Local\Temp\Cleaner.exe
      "C:\Users\Admin\AppData\Local\Temp\Cleaner.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2916
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Log.tmp
      1⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Log.tmp
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:1304
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {4524951B-01DF-4343-9DC0-AB084FC236BB} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Users\Admin\AppData\Roaming\cleaner.exe
        C:\Users\Admin\AppData\Roaming\cleaner.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2952
      • C:\Users\Admin\AppData\Roaming\cleaner.exe
        C:\Users\Admin\AppData\Roaming\cleaner.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1660
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1092
    • C:\Users\Admin\AppData\Local\Temp\Cleaner.exe
      "C:\Users\Admin\AppData\Local\Temp\Cleaner.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2988
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Log.tmp
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:2880

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Log.tmp
      Filesize

      121B

      MD5

      e2eb1a6cb00b9cc2c5f962153b3e4625

      SHA1

      d818f7544f3570dd2789a1e82ddafb9138895646

      SHA256

      8b00d464aca6fcb30306fe599ced03ab96b3b3b100c51a5caa613ba4c24a6ca1

      SHA512

      4a802184057b0d19a81c63aba7a64f0621778ef50cb48e004f13d94d3397a2acc6aaabee7524a34da777bdbb64dcce134b201ece9c6779b8f03c51c0f29422bb

      Download Submit

    • C:\Users\Admin\AppData\Roaming\cleaner.exe
      Filesize

      172KB

      MD5

      9229077d00bad648e91aaf30bd096567

      SHA1

      83eba361175f6c5dd71f740d527ab853a504d15b

      SHA256

      1eca23db92c0319d414040c2ff9a240d57f806290e1f0238d696fea761c5d948

      SHA512

      a8d6ac08eb8a2d74791238bfd73cda0062ac4a706bba6a61472efd4a062e2e611661a931d0d14a7edd52a833be830c254dbc14b184ae30a013687d547bc105a7

      Download Submit

    • memory/1092-52-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

      Download

    • memory/1092-51-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

      Download

    • memory/1660-54-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

      Filesize

      200KB

      Download

    • memory/2480-43-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2480-0-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2480-42-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2480-34-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2480-33-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2480-6-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2480-1-0x0000000000110000-0x0000000000142000-memory.dmp

      Filesize

      200KB

      Download

    • memory/2952-49-0x0000000000250000-0x0000000000282000-memory.dmp

      Filesize

      200KB

      Download