Analysis
- max time kernel
122s - max time network
124s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
22/10/2024, 01:41
General
- Target 9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6.exe
- Size 763KB
- Sample241022-b346ss1fml
- SHA256 9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6
Malware Config
Extracted
-
xworm
-
5.0
-
162.251.122.86:57903
-
fCXrE8L4kRTm48Ov
-
install_file
USB.exe
Extracted
-
redline
-
success
-
162.251.122.86:5798
Extracted
-
vipkeylogger
-
https://api.telegram.org/bot7260827022:AAGnycbSxkSvowZMOoJ8zZlGOgV2Qx7LfZI/sendMessage?chat_id=6487984800
-
https://api.telegram.org/bot7388739443:AAGtGEMG0kgDM1V9rPLWCt4i7ndysEwwYBA/sendMessage?chat_id=1224745150
Signatures
- Detect Xworm Payload 4 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Xworm
Xworm is a remote access trojan written in C#.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6.exe"C:\Users\Admin\AppData\Local\Temp\9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\arrogatingly\pteropod.exe"C:\Users\Admin\AppData\Local\Temp\9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
pteropod.exe
memory/2412-2-0x00000000033D0000-0x00000000037D0000-memory.dmp
memory/2720-12-0x0000000003CB0000-0x00000000040B0000-memory.dmp
memory/2856-24-0x00000000742AE000-0x00000000742AF000-memory.dmp
memory/2856-20-0x0000000000090000-0x00000000000A0000-memory.dmp
memory/2856-16-0x0000000000090000-0x00000000000A0000-memory.dmp
memory/2856-23-0x0000000000090000-0x00000000000A0000-memory.dmp
memory/2856-14-0x0000000000090000-0x00000000000A0000-memory.dmp
memory/2856-25-0x00000000742A0000-0x000000007498E000-memory.dmp
memory/2856-26-0x00000000742AE000-0x00000000742AF000-memory.dmp
memory/2856-27-0x00000000742A0000-0x000000007498E000-memory.dmp
memory/2856-28-0x0000000004C70000-0x0000000004CC2000-memory.dmp
memory/2856-29-0x00000000054D0000-0x000000000551A000-memory.dmp
memory/2856-30-0x0000000005520000-0x000000000556A000-memory.dmp
memory/2856-31-0x00000000742A0000-0x000000007498E000-memory.dmp