Resubmissions
11/08/2024, 17:41
240811-v9en9sthpe 1011/08/2024, 17:38
240811-v7raaazcqq 1028/07/2024, 15:36
240728-s154ravdqg 1023/07/2024, 17:57
240723-wjy6navcle 1023/07/2024, 12:45
240723-py1vgazgkq 10Analysis
-
max time kernel
1792s -
max time network
1797s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 17:41
Behavioral task
behavioral1
Sample
X.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
X.exe
Resource
win10v2004-20240802-en
General
-
Target
X.exe
-
Size
63KB
-
MD5
f16a3a537f873f3e7bd334d6cf93c525
-
SHA1
4fbedba1adbeda56019534b1bf74ff47ed814e61
-
SHA256
ba599c53479ad87732d7d5dab8a4cca44bb55cbc134e6054ddb6414e9cfd1508
-
SHA512
032ec3782acaa2d21b24b8aae659e2bede424e594fee00aafbcf66840a8fd048fceae7ef2a8ad449a38590041d241c7edd1c219e9b5ffb3b5e8993a01ba4011a
-
SSDEEP
1536:zDJ1KwwGadRqckbTz0hdOWwdx6mf6ZOTLGuJi:p14GURjkbTnWvOTJJi
Malware Config
Extracted
xworm
127.0.0.1:7787
92.43.187.26:7787
-
Install_directory
%Temp%
-
install_file
St.exe
Signatures
-
Detect Xworm Payload 14 IoCs
resource yara_rule behavioral1/memory/1324-1-0x00000000003B0000-0x00000000003C6000-memory.dmp family_xworm behavioral1/files/0x00090000000122f7-33.dat family_xworm behavioral1/memory/2900-35-0x0000000000030000-0x0000000000046000-memory.dmp family_xworm behavioral1/memory/1516-40-0x0000000001170000-0x0000000001186000-memory.dmp family_xworm behavioral1/memory/2384-45-0x00000000011C0000-0x00000000011D6000-memory.dmp family_xworm behavioral1/memory/2732-53-0x00000000002F0000-0x0000000000306000-memory.dmp family_xworm behavioral1/memory/2804-55-0x0000000001380000-0x0000000001396000-memory.dmp family_xworm behavioral1/memory/3064-57-0x00000000002C0000-0x00000000002D6000-memory.dmp family_xworm behavioral1/memory/2300-59-0x0000000001060000-0x0000000001076000-memory.dmp family_xworm behavioral1/memory/2460-63-0x00000000000E0000-0x00000000000F6000-memory.dmp family_xworm behavioral1/memory/1844-65-0x00000000001B0000-0x00000000001C6000-memory.dmp family_xworm behavioral1/memory/2092-67-0x0000000000CD0000-0x0000000000CE6000-memory.dmp family_xworm behavioral1/memory/924-69-0x00000000011E0000-0x00000000011F6000-memory.dmp family_xworm behavioral1/memory/2576-71-0x0000000001280000-0x0000000001296000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 996 powershell.exe 2624 powershell.exe 2564 powershell.exe 3012 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\St.lnk X.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\St.lnk X.exe -
Executes dropped EXE 30 IoCs
pid Process 2900 St.exe 1516 St.exe 3044 St.exe 804 St.exe 2080 St.exe 2384 St.exe 2632 St.exe 2720 St.exe 2328 St.exe 2848 St.exe 2988 St.exe 2364 St.exe 2732 St.exe 2804 St.exe 3064 St.exe 2300 St.exe 2492 St.exe 2132 St.exe 2460 St.exe 1844 St.exe 2092 St.exe 924 St.exe 2576 St.exe 2976 St.exe 2248 St.exe 2832 St.exe 2436 St.exe 1740 St.exe 2596 St.exe 2760 St.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\St = "C:\\Users\\Admin\\AppData\\Local\\Temp\\St.exe" X.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2388 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 996 powershell.exe 2624 powershell.exe 2564 powershell.exe 3012 powershell.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1324 X.exe Token: SeDebugPrivilege 996 powershell.exe Token: SeDebugPrivilege 2624 powershell.exe Token: SeDebugPrivilege 2564 powershell.exe Token: SeDebugPrivilege 3012 powershell.exe Token: SeDebugPrivilege 1324 X.exe Token: SeDebugPrivilege 2900 St.exe Token: SeDebugPrivilege 1516 St.exe Token: SeDebugPrivilege 3044 St.exe Token: SeDebugPrivilege 804 St.exe Token: SeDebugPrivilege 2080 St.exe Token: SeDebugPrivilege 2384 St.exe Token: SeDebugPrivilege 2632 St.exe Token: SeDebugPrivilege 2720 St.exe Token: SeDebugPrivilege 2328 St.exe Token: SeDebugPrivilege 2848 St.exe Token: SeDebugPrivilege 2988 St.exe Token: SeDebugPrivilege 2364 St.exe Token: SeDebugPrivilege 2732 St.exe Token: SeDebugPrivilege 2804 St.exe Token: SeDebugPrivilege 3064 St.exe Token: SeDebugPrivilege 2300 St.exe Token: SeDebugPrivilege 2492 St.exe Token: SeDebugPrivilege 2132 St.exe Token: SeDebugPrivilege 2460 St.exe Token: SeDebugPrivilege 1844 St.exe Token: SeDebugPrivilege 2092 St.exe Token: SeDebugPrivilege 924 St.exe Token: SeDebugPrivilege 2576 St.exe Token: SeDebugPrivilege 2976 St.exe Token: SeDebugPrivilege 2248 St.exe Token: SeDebugPrivilege 2832 St.exe Token: SeDebugPrivilege 2436 St.exe Token: SeDebugPrivilege 1740 St.exe Token: SeDebugPrivilege 2596 St.exe Token: SeDebugPrivilege 2760 St.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 996 1324 X.exe 29 PID 1324 wrote to memory of 996 1324 X.exe 29 PID 1324 wrote to memory of 996 1324 X.exe 29 PID 1324 wrote to memory of 2624 1324 X.exe 31 PID 1324 wrote to memory of 2624 1324 X.exe 31 PID 1324 wrote to memory of 2624 1324 X.exe 31 PID 1324 wrote to memory of 2564 1324 X.exe 33 PID 1324 wrote to memory of 2564 1324 X.exe 33 PID 1324 wrote to memory of 2564 1324 X.exe 33 PID 1324 wrote to memory of 3012 1324 X.exe 35 PID 1324 wrote to memory of 3012 1324 X.exe 35 PID 1324 wrote to memory of 3012 1324 X.exe 35 PID 1324 wrote to memory of 2388 1324 X.exe 37 PID 1324 wrote to memory of 2388 1324 X.exe 37 PID 1324 wrote to memory of 2388 1324 X.exe 37 PID 2380 wrote to memory of 2900 2380 taskeng.exe 40 PID 2380 wrote to memory of 2900 2380 taskeng.exe 40 PID 2380 wrote to memory of 2900 2380 taskeng.exe 40 PID 2380 wrote to memory of 1516 2380 taskeng.exe 41 PID 2380 wrote to memory of 1516 2380 taskeng.exe 41 PID 2380 wrote to memory of 1516 2380 taskeng.exe 41 PID 2380 wrote to memory of 3044 2380 taskeng.exe 42 PID 2380 wrote to memory of 3044 2380 taskeng.exe 42 PID 2380 wrote to memory of 3044 2380 taskeng.exe 42 PID 2380 wrote to memory of 804 2380 taskeng.exe 43 PID 2380 wrote to memory of 804 2380 taskeng.exe 43 PID 2380 wrote to memory of 804 2380 taskeng.exe 43 PID 2380 wrote to memory of 2080 2380 taskeng.exe 44 PID 2380 wrote to memory of 2080 2380 taskeng.exe 44 PID 2380 wrote to memory of 2080 2380 taskeng.exe 44 PID 2380 wrote to memory of 2384 2380 taskeng.exe 45 PID 2380 wrote to memory of 2384 2380 taskeng.exe 45 PID 2380 wrote to memory of 2384 2380 taskeng.exe 45 PID 2380 wrote to memory of 2632 2380 taskeng.exe 46 PID 2380 wrote to memory of 2632 2380 taskeng.exe 46 PID 2380 wrote to memory of 2632 2380 taskeng.exe 46 PID 2380 wrote to memory of 2720 2380 taskeng.exe 47 PID 2380 wrote to memory of 2720 2380 taskeng.exe 47 PID 2380 wrote to memory of 2720 2380 taskeng.exe 47 PID 2380 wrote to memory of 2328 2380 taskeng.exe 48 PID 2380 wrote to memory of 2328 2380 taskeng.exe 48 PID 2380 wrote to memory of 2328 2380 taskeng.exe 48 PID 2380 wrote to memory of 2848 2380 taskeng.exe 49 PID 2380 wrote to memory of 2848 2380 taskeng.exe 49 PID 2380 wrote to memory of 2848 2380 taskeng.exe 49 PID 2380 wrote to memory of 2988 2380 taskeng.exe 50 PID 2380 wrote to memory of 2988 2380 taskeng.exe 50 PID 2380 wrote to memory of 2988 2380 taskeng.exe 50 PID 2380 wrote to memory of 2364 2380 taskeng.exe 51 PID 2380 wrote to memory of 2364 2380 taskeng.exe 51 PID 2380 wrote to memory of 2364 2380 taskeng.exe 51 PID 2380 wrote to memory of 2732 2380 taskeng.exe 52 PID 2380 wrote to memory of 2732 2380 taskeng.exe 52 PID 2380 wrote to memory of 2732 2380 taskeng.exe 52 PID 2380 wrote to memory of 2804 2380 taskeng.exe 53 PID 2380 wrote to memory of 2804 2380 taskeng.exe 53 PID 2380 wrote to memory of 2804 2380 taskeng.exe 53 PID 2380 wrote to memory of 3064 2380 taskeng.exe 54 PID 2380 wrote to memory of 3064 2380 taskeng.exe 54 PID 2380 wrote to memory of 3064 2380 taskeng.exe 54 PID 2380 wrote to memory of 2300 2380 taskeng.exe 55 PID 2380 wrote to memory of 2300 2380 taskeng.exe 55 PID 2380 wrote to memory of 2300 2380 taskeng.exe 55 PID 2380 wrote to memory of 2492 2380 taskeng.exe 56 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\X.exe"C:\Users\Admin\AppData\Local\Temp\X.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\X.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'X.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\St.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'St.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "St" /tr "C:\Users\Admin\AppData\Local\Temp\St.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2388
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {2CBAF1ED-F9CC-4B4B-A7F3-9A62C7130CC8} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:804
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
C:\Users\Admin\AppData\Local\Temp\St.exeC:\Users\Admin\AppData\Local\Temp\St.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5f16a3a537f873f3e7bd334d6cf93c525
SHA14fbedba1adbeda56019534b1bf74ff47ed814e61
SHA256ba599c53479ad87732d7d5dab8a4cca44bb55cbc134e6054ddb6414e9cfd1508
SHA512032ec3782acaa2d21b24b8aae659e2bede424e594fee00aafbcf66840a8fd048fceae7ef2a8ad449a38590041d241c7edd1c219e9b5ffb3b5e8993a01ba4011a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TWF270PN32WNHA1ZH9KD.temp
Filesize7KB
MD57b777f80daf4ba282f4f87b04d433bac
SHA1793eeba2d02d0d3f18af754d64dfde931887951c
SHA2561c2ec85eabd6285eb06235bc91da55f44227854103f56784d5b17acab3af5358
SHA51272d1fcdb9d943309ee975a65dc19cfedd009accabf58bae445660abc6f688a58ca03c3761ed7f3135e94c75b593286b458e715faa1088b897ecf24dcd4f8ca7c