Analysis
-
max time kernel
30s -
max time network
7s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
29/10/2024, 22:03
Static task
static1
General
-
Target
WEAPON BET 100.exe
-
Size
14.4MB
-
MD5
ec6587965932d9cea6d50b3f8e49f7b7
-
SHA1
38208370466942f3951fa6826c7e542257d76023
-
SHA256
ba927af3496ca0cb71e48e0f402a8b25d59ff78323a0ee82c39a51fbe3d4789b
-
SHA512
3edd2b01c8d703d7adaab8189dfdc377ff9bf093a432aa5b68b3986876071e72834012fcc5b7559cbfa3535145427e6c4ca218cca7710ca2f08be873ee3fb452
-
SSDEEP
393216:hxJ8UAUPC1PHnCTBknPW9m/UeSD4u7ttU:hxmUAUK1PHnmCWsX2t
Malware Config
Extracted
xworm
185.84.161.64:7000
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x00280000000450fa-19.dat family_xworm behavioral1/memory/3532-29-0x0000000000310000-0x0000000000328000-memory.dmp family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation WEAPON BET 100.exe -
Executes dropped EXE 3 IoCs
pid Process 5008 WEAPON BET 100.exe 3532 svchost.exe 4072 WEAPON BET 100.exe -
Loads dropped DLL 24 IoCs
pid Process 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe 4072 WEAPON BET 100.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ipinfo.io 8 ip-api.com 10 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1768 wmic.exe 1768 wmic.exe 1768 wmic.exe 1768 wmic.exe 656 wmic.exe 656 wmic.exe 656 wmic.exe 656 wmic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3532 svchost.exe Token: SeIncreaseQuotaPrivilege 1768 wmic.exe Token: SeSecurityPrivilege 1768 wmic.exe Token: SeTakeOwnershipPrivilege 1768 wmic.exe Token: SeLoadDriverPrivilege 1768 wmic.exe Token: SeSystemProfilePrivilege 1768 wmic.exe Token: SeSystemtimePrivilege 1768 wmic.exe Token: SeProfSingleProcessPrivilege 1768 wmic.exe Token: SeIncBasePriorityPrivilege 1768 wmic.exe Token: SeCreatePagefilePrivilege 1768 wmic.exe Token: SeBackupPrivilege 1768 wmic.exe Token: SeRestorePrivilege 1768 wmic.exe Token: SeShutdownPrivilege 1768 wmic.exe Token: SeDebugPrivilege 1768 wmic.exe Token: SeSystemEnvironmentPrivilege 1768 wmic.exe Token: SeRemoteShutdownPrivilege 1768 wmic.exe Token: SeUndockPrivilege 1768 wmic.exe Token: SeManageVolumePrivilege 1768 wmic.exe Token: 33 1768 wmic.exe Token: 34 1768 wmic.exe Token: 35 1768 wmic.exe Token: 36 1768 wmic.exe Token: SeIncreaseQuotaPrivilege 1768 wmic.exe Token: SeSecurityPrivilege 1768 wmic.exe Token: SeTakeOwnershipPrivilege 1768 wmic.exe Token: SeLoadDriverPrivilege 1768 wmic.exe Token: SeSystemProfilePrivilege 1768 wmic.exe Token: SeSystemtimePrivilege 1768 wmic.exe Token: SeProfSingleProcessPrivilege 1768 wmic.exe Token: SeIncBasePriorityPrivilege 1768 wmic.exe Token: SeCreatePagefilePrivilege 1768 wmic.exe Token: SeBackupPrivilege 1768 wmic.exe Token: SeRestorePrivilege 1768 wmic.exe Token: SeShutdownPrivilege 1768 wmic.exe Token: SeDebugPrivilege 1768 wmic.exe Token: SeSystemEnvironmentPrivilege 1768 wmic.exe Token: SeRemoteShutdownPrivilege 1768 wmic.exe Token: SeUndockPrivilege 1768 wmic.exe Token: SeManageVolumePrivilege 1768 wmic.exe Token: 33 1768 wmic.exe Token: 34 1768 wmic.exe Token: 35 1768 wmic.exe Token: 36 1768 wmic.exe Token: SeIncreaseQuotaPrivilege 656 wmic.exe Token: SeSecurityPrivilege 656 wmic.exe Token: SeTakeOwnershipPrivilege 656 wmic.exe Token: SeLoadDriverPrivilege 656 wmic.exe Token: SeSystemProfilePrivilege 656 wmic.exe Token: SeSystemtimePrivilege 656 wmic.exe Token: SeProfSingleProcessPrivilege 656 wmic.exe Token: SeIncBasePriorityPrivilege 656 wmic.exe Token: SeCreatePagefilePrivilege 656 wmic.exe Token: SeBackupPrivilege 656 wmic.exe Token: SeRestorePrivilege 656 wmic.exe Token: SeShutdownPrivilege 656 wmic.exe Token: SeDebugPrivilege 656 wmic.exe Token: SeSystemEnvironmentPrivilege 656 wmic.exe Token: SeRemoteShutdownPrivilege 656 wmic.exe Token: SeUndockPrivilege 656 wmic.exe Token: SeManageVolumePrivilege 656 wmic.exe Token: 33 656 wmic.exe Token: 34 656 wmic.exe Token: 35 656 wmic.exe Token: 36 656 wmic.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2668 wrote to memory of 5008 2668 WEAPON BET 100.exe 81 PID 2668 wrote to memory of 5008 2668 WEAPON BET 100.exe 81 PID 2668 wrote to memory of 3532 2668 WEAPON BET 100.exe 82 PID 2668 wrote to memory of 3532 2668 WEAPON BET 100.exe 82 PID 5008 wrote to memory of 4072 5008 WEAPON BET 100.exe 83 PID 5008 wrote to memory of 4072 5008 WEAPON BET 100.exe 83 PID 4072 wrote to memory of 2428 4072 WEAPON BET 100.exe 84 PID 4072 wrote to memory of 2428 4072 WEAPON BET 100.exe 84 PID 4072 wrote to memory of 1768 4072 WEAPON BET 100.exe 90 PID 4072 wrote to memory of 1768 4072 WEAPON BET 100.exe 90 PID 4072 wrote to memory of 656 4072 WEAPON BET 100.exe 92 PID 4072 wrote to memory of 656 4072 WEAPON BET 100.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\WEAPON BET 100.exe"C:\Users\Admin\AppData\Local\Temp\WEAPON BET 100.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Roaming\WEAPON BET 100.exe"C:\Users\Admin\AppData\Roaming\WEAPON BET 100.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\onefile_5008_133747129989887877\WEAPON BET 100.exe"C:\Users\Admin\AppData\Roaming\WEAPON BET 100.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c4⤵PID:2428
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:656
-
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5fe499b0a9f7f361fa705e7c81e1011fa
SHA1cc1c98754c6dab53f5831b05b4df6635ad3f856d
SHA256160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
SHA51260520c5eb5ccc72ae2a4c0f06c8447d9e9922c5f9f1f195757362fc47651adcc1cdbfef193ae4fec7d7c1a47cf1d9756bd820be996ae145f0fbbbfba327c5742
-
Filesize
173KB
MD5eea3e12970e28545a964a95da7e84e0b
SHA1c3ccac86975f2704dabc1ffc3918e81feb3b9ac1
SHA25661f00b0543464bba61e0bd1128118326c9bd0cdc592854dd1a31c3d6d8df2b83
SHA5129bd5c83e7e0ab24d6be40a31ac469a0d9b4621a2a279a5f3ab2fc6401a08c54aec421bc9461aed533a0211d7dbda0c264c5f05aeb39138403da25c8cda0339e6
-
Filesize
64KB
MD5ed2305190284e384a31337094c9f5239
SHA1eb8faebf9fe9438541ca65b9892badc2233a405d
SHA2562cad195ba200cd94702403559323c7abf3772a20203a11beae03770a04437de2
SHA512139c83ebf748720e64c7a6a8f00f45755d17cd8f754cadc0804ece5753c02e5c95210a8b96a92fff89148ba34568f8b1bd6c33d1d3ba7a75f881446956876893
-
Filesize
37KB
MD5fda7d7aada1d15cab2add2f4bd2e59a1
SHA17e61473f2ad5e061ef59105bf4255dbe7db5117a
SHA256b0ed1c62b73b291a1b57e3d8882cc269b2fcbb1253f2947da18d9036e0c985d9
SHA51295c2934a75507ea2d8c817da7e76ee7567ec29a52018aef195fac779b7ffb440c27722d162f8e416b6ef5d3fd0936c71a55776233293b3dd0124d51118a2b628
-
Filesize
292KB
MD550ea156b773e8803f6c1fe712f746cba
SHA12c68212e96605210eddf740291862bdf59398aef
SHA25694edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
SHA51201ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0
-
Filesize
120KB
MD5bf9a9da1cf3c98346002648c3eae6dcf
SHA1db16c09fdc1722631a7a9c465bfe173d94eb5d8b
SHA2564107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637
SHA5127371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654
-
Filesize
5.0MB
MD5123ad0908c76ccba4789c084f7a6b8d0
SHA186de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA2564e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
SHA51280fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
-
Filesize
1.7MB
MD5bed46aa40c392c9068aed5f94857d398
SHA1227561d5f6a592dedd7a8b0ffe0c284f9bbf23e8
SHA25622a1746363151a19e02f92f9b7bc4849038783be34c04f311a11df69fdc1a039
SHA51204850421617366faeaa711fd28dcf58ff1bc5aa2b0cb962fbfc47b5ae645b3726f3decc19d0b36b23c6b00210badeefc67f83ba6f0a81d6de57dc27001ac19be
-
Filesize
1.5MB
MD56ddb534ef5c74627802ceef0c90b38f3
SHA1ffa3b78435e7a121ba6a3de32a7c3950a3f1cb28
SHA256f44fa94865d17e4f0266c8f9a1dd89825d8a0c6c3a63cf4192fc08c8796acabf
SHA5120cf66eeaa3aef2c7da560c370865bbd84ac2e94536bf751907bf42f36c05b5d0c46f883b1f35daf9e21e8eec1a7fcad439e21a23e114ab0a3a0daf39e8c95eb0
-
Filesize
143KB
MD52849986dadc875a7a92889eced861a36
SHA1c723d5e55deb07699f2fc83999b07bd9dab1182e
SHA25684cc14c704067bffd2b4dd411abe752eb492431814cf9ac13417d061a3db0ec3
SHA512b8376fe9ead1f43eebbaee92e649ba528b3eb2d2b774534f46511ea0a1da743438e03bb793b9bc02a59fbadd5ae32e537c29522dd205d2a4d3e584357fa1bdd6
-
Filesize
25.8MB
MD5eeb83a4de48e7728200bb54df8af9439
SHA1105519ee0b6fba1ee8e0535dd708ea3a2c73c530
SHA2566e43d6c7080317fdc38815a41c0c124319b287f6263f9b3885457391e3cf1dbb
SHA5125c9dbf542e6ea50a1126344518ebe354bf3f6594402e33feab80f4d05113ee3c5572117b9e5bbc845ab5067f8720c87e7649b03b2cc3c4869ed3346b9bb721ef
-
Filesize
122KB
MD5302ddf5f83b5887ab9c4b8cc4e40b7a6
SHA10aa06af65d072eb835c8d714d0f0733dc2f47e20
SHA2568250b4c102abd1dba49fc5b52030caa93ca34e00b86cee6547cc0a7f22326807
SHA5125ddc2488fa192d8b662771c698a63faaf109862c8a4dd0df10fb113aef839d012df58346a87178aff9a1b369f82d8ae7819cef4aad542d8bd3f91327feace596
-
Filesize
64KB
MD50abfee1db6c16e8ddaff12cd3e86475b
SHA1b2dda9635ede4f2841912cc50cb3ae67eea89fe7
SHA256b4cec162b985d34ab768f66e8fa41ed28dc2f273fde6670eeace1d695789b137
SHA5120a5cae4e3442af1d62b65e8bf91e0f2a61563c2b971bbf008bfb2de0f038ee472e7bfcc88663dc503b2712e92e6a7e6a5f518ddab1fab2eb435d387b740d2d44
-
Filesize
154KB
MD5e3e7e99b3c2ea56065740b69f1a0bc12
SHA179fa083d6e75a18e8b1e81f612acb92d35bb2aea
SHA256b095fa2eac97496b515031fbea5737988b18deee86a11f2784f5a551732ddc0c
SHA51235cbc30b1ccdc4f5cc9560fc0149373ccd9399eb9297e61d52e6662bb8c56c6a7569d8cfad85aeb057c10558c9352ae086c0467f684fdcf72a137eadf563a909
-
Filesize
31KB
MD5941a3757931719dd40898d88d04690cb
SHA1177ede06a3669389512bfc8a9b282d918257bf8b
SHA256bbe7736caed8c17c97e2b156f686521a788c25f2004aae34ab0c282c24d57da7
SHA5127cfba5c69695c492bf967018b3827073b0c2797b24e1bd43b814fbbb39d1a8b32a2d7ef240e86046e4e07aa06f7266a31b5512d04d98a0d2d3736630c044546e
-
Filesize
81KB
MD5632336eeead53cfad22eb57f795d5657
SHA162f5f73d21b86cd3b73b68e5faec032618196745
SHA256ce3090fff8575b21287df5fc69ae98806646fc302eefadf85e369ad3debad92b
SHA51277965b45060545e210cdb044f25e5fd68d6a9150caf1cad7645dbafcf1ce8e1ccbdf8436fbdcbf5f9c293321c8916e114de30ed8897c7db72df7f8d1f98dfb55
-
Filesize
10KB
MD5d9e0217a89d9b9d1d778f7e197e0c191
SHA1ec692661fcc0b89e0c3bde1773a6168d285b4f0d
SHA256ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0
SHA5123b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
774KB
MD54ff168aaa6a1d68e7957175c8513f3a2
SHA1782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA2562e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
SHA512c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
-
Filesize
6.6MB
MD5b243d61f4248909bc721674d70a633de
SHA11d2fb44b29c4ac3cfd5a7437038a0c541fce82fc
SHA25693488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
SHA51210460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb
-
Filesize
30KB
MD57e871444ca23860a25b888ee263e2eaf
SHA1aa43c9d3abdb1aabda8379f301f8116d0674b590
SHA256dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
SHA5122e260d3123f7ca612901513b90fe40739e85248da913297d4cca3b2ebd398d9697880d148830e168e474ebfc3d30ede10668c7316ed7668f8b39da7bca59e57d
-
Filesize
1KB
MD5e9117326c06fee02c478027cb625c7d8
SHA12ed4092d573289925a5b71625cf43cc82b901daf
SHA256741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
SHA512d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
-
Filesize
1.1MB
MD5098cc6ad04199442c3e2a60e1243c2dc
SHA14c92c464a8e1e56e1c4d77cd30a0da474a026aaf
SHA25664a162d6b11ba10cb11509f3cc445f17beb7acfd064f030b4d59faa1c9894b29
SHA51273c28488b42a0bc2f0d2861fed3f5dcccf8959ce19d3121c13c998db496f2822deb40f36f86240c8d3954fd2dc2ba5d63c8a125b62324dcd92fb6c8ba49ff170
-
Filesize
117KB
MD5862f820c3251e4ca6fc0ac00e4092239
SHA1ef96d84b253041b090c243594f90938e9a487a9a
SHA25636585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
SHA5122f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
-
Filesize
48KB
MD568156f41ae9a04d89bb6625a5cd222d4
SHA13be29d5c53808186eba3a024be377ee6f267c983
SHA25682a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
SHA512f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
-
Filesize
29KB
MD5974b5bd2cdf12789d2ea6f07f19ff964
SHA12673cf0f86d70e85ac2c01207b699c8b169567c4
SHA2564289c991ae42673c43b4b455b6883e4d2583a145813856727fb4bd5bb3e9019e
SHA5128c060f03734d943ca95f16d612ddb4b8ff326aba2fc7839068e9ed3e7a4e70cfefa6f50a6d9362576321dd6d7e10928018b3221270add954691697356d50f85a
-
Filesize
508KB
MD50fc69d380fadbd787403e03a1539a24a
SHA177f067f6d50f1ec97dfed6fae31a9b801632ef17
SHA256641e0b0fa75764812fff544c174f7c4838b57f6272eaae246eb7c483a0a35afc
SHA512e63e200baf817717bdcde53ad664296a448123ffd055d477050b8c7efcab8e4403d525ea3c8181a609c00313f7b390edbb754f0a9278232ade7cfb685270aaf0
-
Filesize
14.3MB
MD58d7c142902b2e17ca69a524bc60a59f9
SHA11e61fdf62bea074e6fa00cacf23e9bdb88990950
SHA256e6f89e70121ab6830e4ec097aed9800fc4fcfecb0d79271480e0f56fe1280d6c
SHA5122e8113b952ba09c86cf11bd4c90c49b7b0340e30b2c1d4f9fc1041ec216e0c73ed011aac5398d7ea29b6d98f1cd160afeecd9c78eb4dd28f6734ac304eaad612
-
Filesize
70KB
MD5ae702d156a2ee10aa0df4e5a365654a1
SHA1bad92787d53da53bda2f180f770752e679ba80c0
SHA25607cc6cdf43c5bfa4c7dc097c3abc5a6fcdfbbda8a52db993ed9f397c4a8af716
SHA5123a6daf7b4ee44cfd6c9a15575f9b4bbc54f22192c72ff4380a2fb3f33227645a4c25cd5cfb15445b446d6485c6bfb38fdf6adf94f121b719ed373e2b5c9a0d9c