Analysis
-
max time kernel
72s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2024, 22:01
Behavioral task
behavioral1
Sample
Deadfr.exe
Resource
win10v2004-20241007-en
General
-
Target
Deadfr.exe
-
Size
35KB
-
MD5
afc6766fb3b5e48943c754a41f8be1b7
-
SHA1
a246d866914632b0dad6aa6c21fd979cbdb60345
-
SHA256
b773c49a75d4b308c5409d9b9111b454849a8e4a8664b7b4e9c60ed0b0b7fa16
-
SHA512
cf16457a2a1c7043f40b1e0fa982665a90bf2a72ff778f45fec85c48b6cdfd7ec4eafbf1b7bd413d6ca35239137367febf43defa09b7e227901ec267e3487e9d
-
SSDEEP
384:TyqLXPCCbuGvSmKzJI9tTSULseqqUB7u5C36gYt9ORtpkFTBLT29pZwoJzVvNV4S:9LTXliB75qgDOFk9/LO/hH/jtYaY
Malware Config
Extracted
xworm
5.0
WDNla7345HFEnugV
-
Install_directory
%Public%
-
install_file
Dean.exe
-
pastebin_url
https://pastebin.com/raw/J09JweeH
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/memory/4824-1-0x0000000000300000-0x0000000000310000-memory.dmp family_xworm behavioral1/files/0x000f000000023a2b-22.dat family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Deadfr.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dean.lnk Deadfr.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dean.lnk Deadfr.exe -
Executes dropped EXE 2 IoCs
pid Process 4756 Dean.exe 1196 Dean.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dean = "C:\\Users\\Public\\Dean.exe" Deadfr.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 24 pastebin.com 25 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5084 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4824 Deadfr.exe Token: SeDebugPrivilege 2128 taskmgr.exe Token: SeSystemProfilePrivilege 2128 taskmgr.exe Token: SeCreateGlobalPrivilege 2128 taskmgr.exe Token: SeDebugPrivilege 4756 Dean.exe Token: SeDebugPrivilege 1196 Dean.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe 2128 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4824 wrote to memory of 5084 4824 Deadfr.exe 92 PID 4824 wrote to memory of 5084 4824 Deadfr.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Deadfr.exe"C:\Users\Admin\AppData\Local\Temp\Deadfr.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Dean" /tr "C:\Users\Public\Dean.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:5084
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2128
-
C:\Users\Public\Dean.exeC:\Users\Public\Dean.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4776
-
C:\Users\Public\Dean.exeC:\Users\Public\Dean.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1196
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
971B
MD59ab678f5a65b1791c6f9a634154d3f68
SHA1cd6d164f27397941a1c3f89d9637cb920d70cfbe
SHA256f1f74c3b84feabf41f3c22e5264a3f544b7c9e9ad84b505714375ca4a49dd4a5
SHA5121ce90211bf0c7f4665a8b6555e2cd8847bcc92e8706f5ca8fc19949da58a7e1177748425be6ecc93f6a4d93e0d86e35e893f9060007f87a30c24afaca34c8abc
-
Filesize
35KB
MD5afc6766fb3b5e48943c754a41f8be1b7
SHA1a246d866914632b0dad6aa6c21fd979cbdb60345
SHA256b773c49a75d4b308c5409d9b9111b454849a8e4a8664b7b4e9c60ed0b0b7fa16
SHA512cf16457a2a1c7043f40b1e0fa982665a90bf2a72ff778f45fec85c48b6cdfd7ec4eafbf1b7bd413d6ca35239137367febf43defa09b7e227901ec267e3487e9d