Overview

overview

10

Static

static

1

INVOICE.js

windows7-x64

10

INVOICE.js

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    INVOICE.js
  • Size 328KB
  • Sample240809-k4twwssfja
  • SHA256 c6b076cf47cd1b57a71acfb1e5d257c657403af0ae983f4084a4057e18e81168
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
stormkittyxwormcredential_accessdiscoveryexecutionpersistenceratstealertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg
  • exe.dropper

    https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • lisa22194141.duckdns.org:7000

Mutex

  • x8iJFYABjI83VZm2

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target
      INVOICE.js
    • Size 328KB
    • SHA256 c6b076cf47cd1b57a71acfb1e5d257c657403af0ae983f4084a4057e18e81168
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    executionstormkittyxwormcredential_accessdiscoverypersistenceratstealertrojan

    • Detect Xworm Payload

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks