Analysis

  • max time kernel
    60s
  • max time network
    66s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 08:13

General

  • Target

    UserOOBEBroker.exe

  • Size

    105.5MB

  • MD5

    3ffa9625fdd39b7160430ec903cd2688

  • SHA1

    2b07febc39ca067b234c1ab574477e459f1574af

  • SHA256

    55268bd92f0f5ed2956d2e5a4cf0f583fd1036197be092c24236d5761752a6ed

  • SHA512

    4e33c44c2e0a7c053c66c378a247ac48787d2f4de00316809d4619b9f09e302d6f0b34a1609667a820a568c2287383290dee8720d80470cc01c9e8d30fddeb9c

  • SSDEEP

    786432:G7aJ7vCmorl0yxfYkyQdBFrJJSl62HjeqHUQvvozHjrxjLmSYbnk6Kno1hiX:

Malware Config

Extracted

Family

xworm

C2

redslide133-49604.portmap.host:49604

wiz.bounceme.net:6000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7245769901:AAG_37K7d0DlKNRIZshszMjtQDXRfUiSCa4/sendMessage?chat_id=6652235050

aes.plain

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/u8f09e5b

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • Detect Xworm Payload 3 IoCs
  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\UserOOBEBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\UserOOBEBroker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Users\Admin\AppData\Local\Temp\wlanext.exe
      "C:\Users\Admin\AppData\Local\Temp\wlanext.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2876
    • C:\Users\Admin\AppData\Local\Temp\VCruntime.exe
      "C:\Users\Admin\AppData\Local\Temp\VCruntime.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\VCruntime.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2260
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'VCruntime.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3800
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\VCruntime.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2068
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "VCruntime" /tr "C:\ProgramData\VCruntime.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 1604
      2⤵
      • Program crash
      PID:4172
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 848 -ip 848
    1⤵
      PID:4728
    • C:\ProgramData\VCruntime.exe
      C:\ProgramData\VCruntime.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4676

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      6d42b6da621e8df5674e26b799c8e2aa

      SHA1

      ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

      SHA256

      5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

      SHA512

      53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      e0aff9af890497944ecf6021b8cae272

      SHA1

      e12479a857b0306bb609a5bbf7f513bca32fb846

      SHA256

      cbb5b9787321f69957badedad4202b46f877a84c4fe9476243328d5fd934fa18

      SHA512

      92040aa745d19bb612c8c1b68172bafac32ad037c173807f551d5049a542f197f1fdbca6d39c3d7e79f528409851a60c7c8f9f26bb985d33036183818a2a25bb

    • C:\Users\Admin\AppData\Local\Temp\VCruntime.exe

      Filesize

      89KB

      MD5

      225850cf18d6e1256f70862fdbd6afb3

      SHA1

      f5b2d3b010eca4d84904a28f8fbc39c2f38a12b4

      SHA256

      69ca909fbad74b756b6094a69da49df464ff5d34b5362e7c19e0ae731c40fb0f

      SHA512

      54d2edd402a959b3790233f521baa06948abff801312fa3cc9b26486679dbf4af3ab8c7a64ebbd89c38f48925647cd3614e96764b60fe27853b185edf78fae6e

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ogf0j50k.ea1.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\wlanext.exe

      Filesize

      32KB

      MD5

      1a89346c2f5d142140070249972a2211

      SHA1

      dec0ec575a56e847843b4253c25861abfc23a898

      SHA256

      b54e2ca4b6324ac1579641c423ee06285590e780184d7a3df6ee0899d8499d9e

      SHA512

      cb78cc5ba228a73e3475812b6361817cf149c22eb644ffb70c56c92d726082400df951c4fbc2aa41d29280bf651e2636ff5390dc6fda3be36382f6436b19ad3c

    • memory/848-0-0x00000000752CE000-0x00000000752CF000-memory.dmp

      Filesize

      4KB

    • memory/848-1-0x0000000000040000-0x0000000001040000-memory.dmp

      Filesize

      16.0MB

    • memory/848-2-0x000000000B2A0000-0x000000000B33C000-memory.dmp

      Filesize

      624KB

    • memory/848-4-0x000000001AC50000-0x000000001E118000-memory.dmp

      Filesize

      52.8MB

    • memory/848-3-0x00000000752C0000-0x0000000075A70000-memory.dmp

      Filesize

      7.7MB

    • memory/848-32-0x00000000752C0000-0x0000000075A70000-memory.dmp

      Filesize

      7.7MB

    • memory/2260-34-0x000001EDC32B0000-0x000001EDC32D2000-memory.dmp

      Filesize

      136KB

    • memory/2876-29-0x00000000711D2000-0x00000000711D3000-memory.dmp

      Filesize

      4KB

    • memory/2876-31-0x00000000711D0000-0x0000000071781000-memory.dmp

      Filesize

      5.7MB

    • memory/2876-30-0x00000000711D0000-0x0000000071781000-memory.dmp

      Filesize

      5.7MB

    • memory/2876-81-0x00000000711D2000-0x00000000711D3000-memory.dmp

      Filesize

      4KB

    • memory/2876-82-0x00000000711D0000-0x0000000071781000-memory.dmp

      Filesize

      5.7MB

    • memory/3984-33-0x000000001B3C0000-0x000000001B3D0000-memory.dmp

      Filesize

      64KB

    • memory/3984-28-0x0000000000660000-0x000000000067C000-memory.dmp

      Filesize

      112KB

    • memory/3984-27-0x00007FFAA7143000-0x00007FFAA7145000-memory.dmp

      Filesize

      8KB

    • memory/3984-77-0x000000001B8D0000-0x000000001B9D2000-memory.dmp

      Filesize

      1.0MB

    • memory/3984-78-0x000000001C3A0000-0x000000001C3AE000-memory.dmp

      Filesize

      56KB

    • memory/3984-80-0x00007FFAA7143000-0x00007FFAA7145000-memory.dmp

      Filesize

      8KB

    • memory/3984-83-0x000000001B3C0000-0x000000001B3D0000-memory.dmp

      Filesize

      64KB