Analysis
-
max time kernel
20s -
max time network
22s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
29/10/2024, 22:55
General
-
Target
DisconnectLoader.exe
-
Size
299KB
-
MD5
a1402e4eb98f1315e539ae57cf6553e2
-
SHA1
5c01edfd70d19c0cf8939930dd5577476f0b76d2
-
SHA256
1f03986d28f33070e9d13e9337f8a1f84b1e4c3cb02db0613b7f3ca4c0aa02b5
-
SHA512
dade0482a6b0b26cf713bfa7623f84199bd33e1d087af826d6f25af1b9204902d7ca2a38bad66a42ea074ef8f54785590236ac797b65d88ff2b96765f2ebb4b7
-
SSDEEP
3072:fufodFK9MKOj7H2QAsSdADRq6ty71wtYM77ldY7AXTp2kA3:frK9IHuwH77Ppj0kA
Malware Config
Extracted
xworm
5.0
dane1c-58098.portmap.host:58098
scIy1UkjzpZZKLfI
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2748-1-0x0000000000430000-0x0000000000482000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2168 powershell.exe 4840 powershell.exe 4724 powershell.exe 4136 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation DisconnectLoader.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DisconnectCheats.lnk DisconnectLoader.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DisconnectCheats.lnk DisconnectLoader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4724 powershell.exe 4724 powershell.exe 4136 powershell.exe 4136 powershell.exe 2168 powershell.exe 2168 powershell.exe 4840 powershell.exe 4840 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2748 DisconnectLoader.exe Token: SeDebugPrivilege 4724 powershell.exe Token: SeIncreaseQuotaPrivilege 4724 powershell.exe Token: SeSecurityPrivilege 4724 powershell.exe Token: SeTakeOwnershipPrivilege 4724 powershell.exe Token: SeLoadDriverPrivilege 4724 powershell.exe Token: SeSystemProfilePrivilege 4724 powershell.exe Token: SeSystemtimePrivilege 4724 powershell.exe Token: SeProfSingleProcessPrivilege 4724 powershell.exe Token: SeIncBasePriorityPrivilege 4724 powershell.exe Token: SeCreatePagefilePrivilege 4724 powershell.exe Token: SeBackupPrivilege 4724 powershell.exe Token: SeRestorePrivilege 4724 powershell.exe Token: SeShutdownPrivilege 4724 powershell.exe Token: SeDebugPrivilege 4724 powershell.exe Token: SeSystemEnvironmentPrivilege 4724 powershell.exe Token: SeRemoteShutdownPrivilege 4724 powershell.exe Token: SeUndockPrivilege 4724 powershell.exe Token: SeManageVolumePrivilege 4724 powershell.exe Token: 33 4724 powershell.exe Token: 34 4724 powershell.exe Token: 35 4724 powershell.exe Token: 36 4724 powershell.exe Token: SeDebugPrivilege 4136 powershell.exe Token: SeIncreaseQuotaPrivilege 4136 powershell.exe Token: SeSecurityPrivilege 4136 powershell.exe Token: SeTakeOwnershipPrivilege 4136 powershell.exe Token: SeLoadDriverPrivilege 4136 powershell.exe Token: SeSystemProfilePrivilege 4136 powershell.exe Token: SeSystemtimePrivilege 4136 powershell.exe Token: SeProfSingleProcessPrivilege 4136 powershell.exe Token: SeIncBasePriorityPrivilege 4136 powershell.exe Token: SeCreatePagefilePrivilege 4136 powershell.exe Token: SeBackupPrivilege 4136 powershell.exe Token: SeRestorePrivilege 4136 powershell.exe Token: SeShutdownPrivilege 4136 powershell.exe Token: SeDebugPrivilege 4136 powershell.exe Token: SeSystemEnvironmentPrivilege 4136 powershell.exe Token: SeRemoteShutdownPrivilege 4136 powershell.exe Token: SeUndockPrivilege 4136 powershell.exe Token: SeManageVolumePrivilege 4136 powershell.exe Token: 33 4136 powershell.exe Token: 34 4136 powershell.exe Token: 35 4136 powershell.exe Token: 36 4136 powershell.exe Token: SeDebugPrivilege 2168 powershell.exe Token: SeIncreaseQuotaPrivilege 2168 powershell.exe Token: SeSecurityPrivilege 2168 powershell.exe Token: SeTakeOwnershipPrivilege 2168 powershell.exe Token: SeLoadDriverPrivilege 2168 powershell.exe Token: SeSystemProfilePrivilege 2168 powershell.exe Token: SeSystemtimePrivilege 2168 powershell.exe Token: SeProfSingleProcessPrivilege 2168 powershell.exe Token: SeIncBasePriorityPrivilege 2168 powershell.exe Token: SeCreatePagefilePrivilege 2168 powershell.exe Token: SeBackupPrivilege 2168 powershell.exe Token: SeRestorePrivilege 2168 powershell.exe Token: SeShutdownPrivilege 2168 powershell.exe Token: SeDebugPrivilege 2168 powershell.exe Token: SeSystemEnvironmentPrivilege 2168 powershell.exe Token: SeRemoteShutdownPrivilege 2168 powershell.exe Token: SeUndockPrivilege 2168 powershell.exe Token: SeManageVolumePrivilege 2168 powershell.exe Token: 33 2168 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2748 wrote to memory of 4724 2748 DisconnectLoader.exe 84 PID 2748 wrote to memory of 4724 2748 DisconnectLoader.exe 84 PID 2748 wrote to memory of 4136 2748 DisconnectLoader.exe 87 PID 2748 wrote to memory of 4136 2748 DisconnectLoader.exe 87 PID 2748 wrote to memory of 2168 2748 DisconnectLoader.exe 89 PID 2748 wrote to memory of 2168 2748 DisconnectLoader.exe 89 PID 2748 wrote to memory of 4840 2748 DisconnectLoader.exe 91 PID 2748 wrote to memory of 4840 2748 DisconnectLoader.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\DisconnectLoader.exe"C:\Users\Admin\AppData\Local\Temp\DisconnectLoader.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\DisconnectLoader.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DisconnectLoader.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\DisconnectCheats'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DisconnectCheats'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53eb3833f769dd890afc295b977eab4b4
SHA1e857649b037939602c72ad003e5d3698695f436f
SHA256c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
SHA512c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
-
Filesize
1KB
MD560b3262c3163ee3d466199160b9ed07d
SHA1994ece4ea4e61de0be2fdd580f87e3415f9e1ff6
SHA256e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb
SHA512081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af
-
Filesize
1KB
MD5becf00b8822243d7ad41ee23eb4b1e03
SHA1870dda32552f2ca6eaee65e9137575a747333be2
SHA25699d37b5d8d26ef278b47e18b7387df39e4b5af984c0a5f654e1f7a1d6ff65732
SHA5128a001354ac0b6d4f59f386cdece44218bb47678f74278e90d02443f13ab706fc98a8ac51ac4698f3b4135dc9ac1f36a24dd0648c5453b53fe3cb0c29640503f2
-
Filesize
1KB
MD59369c43c8a53001f4ed6cba1d86a7129
SHA16e5d12b3f50640b3e3839462a92c3a13491ca9f8
SHA256167717e456d884560eeb5fafa95e686b27ac84b5c4c77f1d73f66ccd08362b28
SHA5128161471d75088be99a6f66845e9d73aaca4c86b6b6132f3257f337920ada6d4c1a4f965ed9796a11452cd365ca5b052a948a53bf7dcad213688ab524bb5b5fc2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82