Overview

overview

10

Static

static

10

Process Hacker.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    238s
  • max time network
    237s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/08/2024, 18:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Process Hacker.exe

  • Size

    35KB

  • MD5

    488bce36a8946cabbda91977ac002c8a

  • SHA1

    6fa107cb8306e78116218f13ee59130909bd0877

  • SHA256

    0e44f48556c67d7786b44877ced76acdc197b22a813a9369bc763cd8d67d8d7e

  • SHA512

    145c818f8861395f38fc68d05ea10efbf8b38d83fc24ec618b3b442aa02c839d6cdfd213b94815a1312fdd44ff89c1a348a9d98da3be8ae69923202fddb59c80

  • SSDEEP

    768:i0n8WmWOBf2novdCLQJFFGTka5Fyp94/6pOjhZyl6:i88WmWOBaoYLQbITZF094/6pOjrJ

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

library-attachments.gl.at.ply.gg:8838

Mutex

8gfrV5Z3IRPvpjTp

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Process Hacker.exe
    "C:\Users\Admin\AppData\Local\Temp\Process Hacker.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Process Hacker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4876
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Process Hacker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2056
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5076
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1008
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4232
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2384
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2084
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1612
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4964
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1840
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1216
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4436
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4956
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4384
    • C:\Users\Admin\AppData\Local\Temp\Process Hacker.exe
      "C:\Users\Admin\AppData\Local\Temp\Process Hacker.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:864
    • C:\Users\Admin\AppData\Local\Temp\Process Hacker.exe
      "C:\Users\Admin\AppData\Local\Temp\Process Hacker.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5080

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
            Filesize

            64KB

            MD5

            d2fb266b97caff2086bf0fa74eddb6b2

            SHA1

            2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

            SHA256

            b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

            SHA512

            c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

            Download Submit

          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
            Filesize

            4B

            MD5

            f49655f856acb8884cc0ace29216f511

            SHA1

            cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

            SHA256

            7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

            SHA512

            599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

            Download Submit

          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
            Filesize

            944B

            MD5

            6bd369f7c74a28194c991ed1404da30f

            SHA1

            0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

            SHA256

            878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

            SHA512

            8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
            Filesize

            654B

            MD5

            2ff39f6c7249774be85fd60a8f9a245e

            SHA1

            684ff36b31aedc1e587c8496c02722c6698c1c4e

            SHA256

            e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

            SHA512

            1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            77d622bb1a5b250869a3238b9bc1402b

            SHA1

            d47f4003c2554b9dfc4c16f22460b331886b191b

            SHA256

            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

            SHA512

            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            ec1a34551a09c6a39b4da112ec5e93cb

            SHA1

            920291dc5a3ff704e0d4e218c4061405f2dd52cb

            SHA256

            0eb1549ef95cb6465a9751fb5342013a5dc0eece60bdf1152b1eb5216fee47fe

            SHA512

            a0886efe4ca3aa2848f23b6cc54955c1d4f02a57fc3ab36c823dd3b467d1d3b80359f254f506e7aeb0da35e0e3b1eec74b7ac78ec01b0405a247943712321bba

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            22310ad6749d8cc38284aa616efcd100

            SHA1

            440ef4a0a53bfa7c83fe84326a1dff4326dcb515

            SHA256

            55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

            SHA512

            2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5rip1a3o.tpr.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk
            Filesize

            780B

            MD5

            0db58b9f35d97eb47d30adf555fa7da0

            SHA1

            294cf9ee527f280fd35d91062e2da532da40eae1

            SHA256

            fcab57c825df988414b5400e4fdfeee4e2f94602dfd3786e077a61d70e043cc4

            SHA512

            908f07c1ee748b296ce8251f29c47959d7e1b0c874faab80a5bc9f39bd696d223cb973645113fe5f5cfa78ec32c32b4df89b2f29164300c8d2f2e8ea95d411bd

            Download Submit

          • C:\Users\Admin\svchost.exe
            Filesize

            35KB

            MD5

            488bce36a8946cabbda91977ac002c8a

            SHA1

            6fa107cb8306e78116218f13ee59130909bd0877

            SHA256

            0e44f48556c67d7786b44877ced76acdc197b22a813a9369bc763cd8d67d8d7e

            SHA512

            145c818f8861395f38fc68d05ea10efbf8b38d83fc24ec618b3b442aa02c839d6cdfd213b94815a1312fdd44ff89c1a348a9d98da3be8ae69923202fddb59c80

            Download Submit

          • memory/1008-66-0x0000018A7C480000-0x0000018A7C481000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1008-67-0x0000018A7C480000-0x0000018A7C481000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1008-64-0x0000018A7C480000-0x0000018A7C481000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1008-58-0x0000018A7C480000-0x0000018A7C481000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1008-59-0x0000018A7C480000-0x0000018A7C481000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1008-60-0x0000018A7C480000-0x0000018A7C481000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1008-70-0x0000018A7C480000-0x0000018A7C481000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1008-69-0x0000018A7C480000-0x0000018A7C481000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1008-68-0x0000018A7C480000-0x0000018A7C481000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1008-65-0x0000018A7C480000-0x0000018A7C481000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1856-1-0x00007FFE6E7C3000-0x00007FFE6E7C5000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1856-56-0x00007FFE6E7C0000-0x00007FFE6F281000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/1856-57-0x00007FFE6E7C0000-0x00007FFE6F281000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/1856-0-0x00000000009C0000-0x00000000009D0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4876-17-0x00007FFE6E7C0000-0x00007FFE6F281000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4876-14-0x00007FFE6E7C0000-0x00007FFE6F281000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4876-13-0x00007FFE6E7C0000-0x00007FFE6F281000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4876-12-0x00007FFE6E7C0000-0x00007FFE6F281000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4876-2-0x0000026E79140000-0x0000026E79162000-memory.dmp

            Filesize

            136KB

            Download