Analysis

  • max time kernel
    20s
  • max time network
    22s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    29/10/2024, 22:55

General

  • Target

    DisconnectLoader.exe

  • Size

    299KB

  • MD5

    a1402e4eb98f1315e539ae57cf6553e2

  • SHA1

    5c01edfd70d19c0cf8939930dd5577476f0b76d2

  • SHA256

    1f03986d28f33070e9d13e9337f8a1f84b1e4c3cb02db0613b7f3ca4c0aa02b5

  • SHA512

    dade0482a6b0b26cf713bfa7623f84199bd33e1d087af826d6f25af1b9204902d7ca2a38bad66a42ea074ef8f54785590236ac797b65d88ff2b96765f2ebb4b7

  • SSDEEP

    3072:fufodFK9MKOj7H2QAsSdADRq6ty71wtYM77ldY7AXTp2kA3:frK9IHuwH77Ppj0kA

Malware Config

Extracted

Family

xworm

Version

5.0

C2

dane1c-58098.portmap.host:58098

Mutex

scIy1UkjzpZZKLfI

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DisconnectLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\DisconnectLoader.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\DisconnectLoader.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4724
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DisconnectLoader.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4136
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\DisconnectCheats'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2168
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DisconnectCheats'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4840

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          3KB

          MD5

          3eb3833f769dd890afc295b977eab4b4

          SHA1

          e857649b037939602c72ad003e5d3698695f436f

          SHA256

          c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

          SHA512

          c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          60b3262c3163ee3d466199160b9ed07d

          SHA1

          994ece4ea4e61de0be2fdd580f87e3415f9e1ff6

          SHA256

          e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb

          SHA512

          081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          becf00b8822243d7ad41ee23eb4b1e03

          SHA1

          870dda32552f2ca6eaee65e9137575a747333be2

          SHA256

          99d37b5d8d26ef278b47e18b7387df39e4b5af984c0a5f654e1f7a1d6ff65732

          SHA512

          8a001354ac0b6d4f59f386cdece44218bb47678f74278e90d02443f13ab706fc98a8ac51ac4698f3b4135dc9ac1f36a24dd0648c5453b53fe3cb0c29640503f2

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          9369c43c8a53001f4ed6cba1d86a7129

          SHA1

          6e5d12b3f50640b3e3839462a92c3a13491ca9f8

          SHA256

          167717e456d884560eeb5fafa95e686b27ac84b5c4c77f1d73f66ccd08362b28

          SHA512

          8161471d75088be99a6f66845e9d73aaca4c86b6b6132f3257f337920ada6d4c1a4f965ed9796a11452cd365ca5b052a948a53bf7dcad213688ab524bb5b5fc2

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jqrlajfo.4hd.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/2168-44-0x000001A1F5970000-0x000001A1F5B8D000-memory.dmp

          Filesize

          2.1MB

        • memory/2748-62-0x00007FFFC44C0000-0x00007FFFC4F82000-memory.dmp

          Filesize

          10.8MB

        • memory/2748-61-0x00007FFFC44C0000-0x00007FFFC4F82000-memory.dmp

          Filesize

          10.8MB

        • memory/2748-57-0x00007FFFC44C3000-0x00007FFFC44C5000-memory.dmp

          Filesize

          8KB

        • memory/2748-0-0x00007FFFC44C3000-0x00007FFFC44C5000-memory.dmp

          Filesize

          8KB

        • memory/2748-1-0x0000000000430000-0x0000000000482000-memory.dmp

          Filesize

          328KB

        • memory/4136-32-0x0000026C65E40000-0x0000026C6605D000-memory.dmp

          Filesize

          2.1MB

        • memory/4724-16-0x00007FFFC44C0000-0x00007FFFC4F82000-memory.dmp

          Filesize

          10.8MB

        • memory/4724-11-0x00000233FD2C0000-0x00000233FD2E2000-memory.dmp

          Filesize

          136KB

        • memory/4724-19-0x00007FFFC44C0000-0x00007FFFC4F82000-memory.dmp

          Filesize

          10.8MB

        • memory/4724-12-0x00007FFFC44C0000-0x00007FFFC4F82000-memory.dmp

          Filesize

          10.8MB

        • memory/4724-15-0x00007FFFC44C0000-0x00007FFFC4F82000-memory.dmp

          Filesize

          10.8MB

        • memory/4724-14-0x00007FFFC44C0000-0x00007FFFC4F82000-memory.dmp

          Filesize

          10.8MB

        • memory/4724-13-0x00007FFFC44C0000-0x00007FFFC4F82000-memory.dmp

          Filesize

          10.8MB

        • memory/4840-56-0x0000018C35210000-0x0000018C3542D000-memory.dmp

          Filesize

          2.1MB