General

  • Target

    downloader.exe

  • Size

    70.1MB

  • Sample

    240824-prcjaszfkc

  • MD5

    313c3b8cfe6d66ee879a14e3f29f543b

  • SHA1

    4e9dd98d84be6197b5088205e17bdabab48074ea

  • SHA256

    e71824ee54837240843a2df469a0f587db8d39dd44173f6ce822890b677c4ed1

  • SHA512

    a6efa093cd77343f3cc0ac6319337416ef9fa27fd63fd20cccf3ff2ea19233d505c7d3cac85ffdeaef9cbdf85957c1016b3996d42171c26e061f3de894a1e6a2

  • SSDEEP

    393216:lWxQN89qQk4adiJCuE2fUCdod+OvqKkZHzXhJ/KTe8uiBUtkc0k3qIsGg4GUo3Nw:lWoI7zG+5ahWc3Ime

Malware Config

Extracted

Family

xworm

C2

83.38.19.195:1603

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Runtime Broker.exe

Targets

    • Target

      downloader.exe

    • Size

      70.1MB

    • MD5

      313c3b8cfe6d66ee879a14e3f29f543b

    • SHA1

      4e9dd98d84be6197b5088205e17bdabab48074ea

    • SHA256

      e71824ee54837240843a2df469a0f587db8d39dd44173f6ce822890b677c4ed1

    • SHA512

      a6efa093cd77343f3cc0ac6319337416ef9fa27fd63fd20cccf3ff2ea19233d505c7d3cac85ffdeaef9cbdf85957c1016b3996d42171c26e061f3de894a1e6a2

    • SSDEEP

      393216:lWxQN89qQk4adiJCuE2fUCdod+OvqKkZHzXhJ/KTe8uiBUtkc0k3qIsGg4GUo3Nw:lWoI7zG+5ahWc3Ime

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks