Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
09/08/2024, 08:13
General
- Target screensaver.exe
- Size 40KB
- Sample240809-j4lpvaybnm
- SHA256 1c8cc063b64f9c4f5beb55f64cf19efb96e2e9d592c221366ec9ceafc4f9c545
Malware Config
Extracted
-
xworm
-
5.0
-
memorialwords.xyz:4444
-
0FDfqtSCPc6omfwK
-
Install_directory
%AppData%
-
install_file
Adobe\Reader\updater.exe
Extracted
-
redline
-
xclient
-
memorialwords.xyz:6666
Signatures
- Detect Xworm Payload 2 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\screensaver.exe"C:\Users\Admin\AppData\Local\Temp\screensaver.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "updater" /tr "C:\Users\Admin\AppData\Roaming\Adobe\Reader\updater.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\ejzkxl.exe"C:\Users\Admin\AppData\Local\Temp\ejzkxl.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Adobe\Reader\updater.exeC:\Users\Admin\AppData\Roaming\Adobe\Reader\updater.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Adobe\Reader\updater.exeC:\Users\Admin\AppData\Roaming\Adobe\Reader\updater.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Adobe\Reader\updater.exeC:\Users\Admin\AppData\Roaming\Adobe\Reader\updater.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
updater.exe.log
ejzkxl.exe
tmp148E.tmp
tmp14E2.tmp
tmp150D.tmp
tmp1513.tmp
tmp1529.tmp
tmp1544.tmp
updater.exe
memory/3432-267-0x000000001E420000-0x000000001E442000-memory.dmp
memory/3432-228-0x000000001E2D0000-0x000000001E3EE000-memory.dmp
memory/3432-0-0x00007FF82AA93000-0x00007FF82AA95000-memory.dmp
memory/3432-22-0x00007FF82AA90000-0x00007FF82B551000-memory.dmp
memory/3432-5-0x00007FF82AA93000-0x00007FF82AA95000-memory.dmp
memory/3432-2-0x00007FF82AA90000-0x00007FF82B551000-memory.dmp
memory/3432-1-0x0000000000A50000-0x0000000000A60000-memory.dmp
memory/3472-19-0x0000000005490000-0x00000000054A2000-memory.dmp
memory/3472-186-0x0000000006D70000-0x0000000006DD6000-memory.dmp
memory/3472-31-0x0000000006CD0000-0x0000000006D62000-memory.dmp
memory/3472-29-0x0000000007160000-0x000000000768C000-memory.dmp
memory/3472-28-0x0000000006A60000-0x0000000006C22000-memory.dmp
memory/3472-24-0x0000000005780000-0x000000000588A000-memory.dmp
memory/3472-23-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3472-21-0x0000000005530000-0x000000000557C000-memory.dmp
memory/3472-20-0x00000000054F0000-0x000000000552C000-memory.dmp
memory/3472-30-0x0000000007C40000-0x00000000081E4000-memory.dmp
memory/3472-226-0x0000000007810000-0x0000000007886000-memory.dmp
memory/3472-227-0x0000000007890000-0x00000000078AE000-memory.dmp
memory/3472-18-0x0000000005A90000-0x00000000060A8000-memory.dmp
memory/3472-17-0x0000000000AB0000-0x0000000000ACE000-memory.dmp
memory/3472-268-0x000000007523E000-0x000000007523F000-memory.dmp
memory/3472-269-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3472-16-0x000000007523E000-0x000000007523F000-memory.dmp