Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
17/10/2024, 01:32
General
- Target 5275e3db6276e5f0b85eff0c7b0282f56268646766b1566ba8f797e6ba2a9357.exe
- Size 1.3MB
- Sample241017-byfmmsvdrg
- SHA256 5275e3db6276e5f0b85eff0c7b0282f56268646766b1566ba8f797e6ba2a9357
Malware Config
Extracted
-
xworm
-
5.0
-
104.219.239.11:6969
-
QMHDjhLW52nOcp4a
-
Install_directory
%AppData%
-
install_file
OneDrive.exe
-
telegram
https://api.telegram.org/bot5372344229:AAEM46DF5hWBLPbN5UErJaoJvlNvm-ZJXyg
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload 3 IoCs
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5275e3db6276e5f0b85eff0c7b0282f56268646766b1566ba8f797e6ba2a9357.exe"C:\Users\Admin\AppData\Local\Temp\5275e3db6276e5f0b85eff0c7b0282f56268646766b1566ba8f797e6ba2a9357.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANQAyADcANQBlADMAZABiADYAMgA3ADYAZQA1AGYAMABiADgANQBlAGYAZgAwAGMANwBiADAAMgA4ADIAZgA1ADYAMgA2ADgANgA0ADYANwA2ADYAYgAxADUANgA2AGIAYQA4AGYANwA5ADcAZQA2AGIAYQAyAGEAOQAzADUANwAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAA1ADIANwA1AGUAMwBkAGIANgAyADcANgBlADUAZgAwAGIAOAA1AGUAZgBmADAAYwA3AGIAMAAyADgAMgBmADUANgAyADYAOAA2ADQANgA3ADYANgBiADEANQA2ADYAYgBhADgAZgA3ADkANwBlADYAYgBhADIAYQA5ADMANQA3AC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAZABvAGMAdQBtAGUAbgB0AHMAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\ibqeqo.exe"C:\Users\Admin\AppData\Local\Temp\ibqeqo.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_e4wtuaig.ddx.ps1
ibqeqo.exe
memory/3256-1127-0x0000000000310000-0x000000000033A000-memory.dmp
memory/4284-20-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-1078-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-44-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-32-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-14-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-10-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-8-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-6-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-65-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-63-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-61-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-59-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-57-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-55-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-53-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-51-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-50-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-48-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-46-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-42-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-40-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-38-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-36-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-34-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-30-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-28-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-26-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-24-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-22-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-12-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-67-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-18-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-2-0x000001CDE9EF0000-0x000001CDE9FF6000-memory.dmp
memory/4284-4-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-3-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-16-0x000001CDE9EF0000-0x000001CDE9FF1000-memory.dmp
memory/4284-1079-0x000001CDEA170000-0x000001CDEA1F0000-memory.dmp
memory/4284-1080-0x000001CDEA1F0000-0x000001CDEA23C000-memory.dmp
memory/4284-1085-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-1084-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-1086-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-1087-0x00007FF976223000-0x00007FF976225000-memory.dmp
memory/4284-1105-0x000001CDEA560000-0x000001CDEA5B4000-memory.dmp
memory/4284-1109-0x000001CDEA630000-0x000001CDEA65C000-memory.dmp
memory/4284-1110-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-1111-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-1169-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-1112-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-1113-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-1114-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-1116-0x000001CDEA980000-0x000001CDEA98E000-memory.dmp
memory/4284-1-0x000001CDE7850000-0x000001CDE799A000-memory.dmp
memory/4284-0-0x00007FF976223000-0x00007FF976225000-memory.dmp
memory/4284-1128-0x000001CDEB6A0000-0x000001CDEB7C0000-memory.dmp
memory/4284-1138-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4284-1168-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4672-1089-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4672-1090-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4672-1096-0x000002197AFE0000-0x000002197B002000-memory.dmp
memory/4672-1101-0x00007FF976220000-0x00007FF976CE1000-memory.dmp
memory/4672-1104-0x00007FF976220000-0x00007FF976CE1000-memory.dmp