Analysis

  • max time kernel
    39s
  • max time network
    40s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    31/10/2024, 04:48

General

  • Target

    NitroGen.exe

  • Size

    76KB

  • MD5

    f2969199c528611db2c3aa1cb01bf3be

  • SHA1

    ae8bd3ac37c949a507239859b5a3280705d36cdb

  • SHA256

    80c21c8ed69aed6da6dd3422e29238d41c76db39ad0a94d388f22d1df01888e2

  • SHA512

    bb9710c6ed95dd94942632b24e86a14eacc555695f60bcb33f2a9af51e6603fd32c7c8e0d1ebd67ee59cc38c8393ede5eeca9675de97f5ccb7c75f0fe29a2760

  • SSDEEP

    1536:7NCPl72PIk5az4V1JEw+bD1/sk/0ZvJ6/YOwe5VMuP4Uc:hSTkIz21Gw+bDqFrOwe5KPR

Malware Config

Extracted

Family

xworm

C2

104.154.53.10:7000

Attributes
  • Install_directory

    %Temp%

  • install_file

    Registry.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NitroGen.exe
    "C:\Users\Admin\AppData\Local\Temp\NitroGen.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\NitroGen.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:192
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NitroGen.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4272
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Registry.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4280
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Registry.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4500
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Registry" /tr "C:\Users\Admin\AppData\Local\Temp\Registry.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1160

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          3KB

          MD5

          3eb3833f769dd890afc295b977eab4b4

          SHA1

          e857649b037939602c72ad003e5d3698695f436f

          SHA256

          c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

          SHA512

          c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          af1cc13f412ef37a00e668df293b1584

          SHA1

          8973b3e622f187fcf484a0eb9fa692bf3e2103cb

          SHA256

          449c0c61734cf23f28ad05a7e528f55dd8a7c6ae7a723253707e5f73de187037

          SHA512

          75d954ec8b98f804d068635875fac06e9594874f0f5d6e2ad9d6267285d1d4a1de6309009de9e2956c6477a888db648396f77a1a49b58287d2683b8214e7a3d3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          c89671578badca1980abd30ee08c6ef4

          SHA1

          79cc06f7e038f551be97625c3c5ea0255b89ee25

          SHA256

          1cf4b698e3120b83ce7b04f5582a430d04c4a47e0bd8fe1d1b136eb7ea141117

          SHA512

          d330c8848fff27bf98f880e58541d08f59a1d8e27ffe1bd6392a65d8057c402eae642f92305303a0a370803f9adba6d5e350e1aeb0f4cea65769d7adc93edf65

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          705133121e18d0f8fab7848502dc9b85

          SHA1

          e03a4425450c04e3cd5ccc07424a1989ca12ea27

          SHA256

          88eb8c45ee90ecbc0edbe0b2108b2ace11cda293150ba75388808043a105ea3f

          SHA512

          d88de3a89f05f711551d2ffaa16b3caf5b2616849f0d1391bc382ce3539f9b4614b6188d6bddbc33bead418c38ce7173f45e716c42be5aa1413dad90def9e0ff

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bcis4ju1.3dz.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/192-12-0x00007FFC09330000-0x00007FFC09DF2000-memory.dmp

          Filesize

          10.8MB

        • memory/192-14-0x00007FFC09330000-0x00007FFC09DF2000-memory.dmp

          Filesize

          10.8MB

        • memory/192-15-0x00007FFC09330000-0x00007FFC09DF2000-memory.dmp

          Filesize

          10.8MB

        • memory/192-16-0x00007FFC09330000-0x00007FFC09DF2000-memory.dmp

          Filesize

          10.8MB

        • memory/192-19-0x00007FFC09330000-0x00007FFC09DF2000-memory.dmp

          Filesize

          10.8MB

        • memory/192-13-0x00007FFC09330000-0x00007FFC09DF2000-memory.dmp

          Filesize

          10.8MB

        • memory/192-11-0x00000258C9B00000-0x00000258C9B22000-memory.dmp

          Filesize

          136KB

        • memory/2272-0-0x00007FFC09333000-0x00007FFC09335000-memory.dmp

          Filesize

          8KB

        • memory/2272-1-0x00000000008A0000-0x00000000008BA000-memory.dmp

          Filesize

          104KB

        • memory/2272-54-0x00007FFC09333000-0x00007FFC09335000-memory.dmp

          Filesize

          8KB

        • memory/2272-59-0x00007FFC09330000-0x00007FFC09DF2000-memory.dmp

          Filesize

          10.8MB

        • memory/2272-60-0x00007FFC09330000-0x00007FFC09DF2000-memory.dmp

          Filesize

          10.8MB