Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
03-11-2024 00:20
Static task
static1
1 signatures
General
-
Target
Dragon.exe
-
Size
275KB
-
MD5
4a2b87da39aa0c18015c52982d9b041e
-
SHA1
418bb0b60e5613abfd28348bdee58a009122e66e
-
SHA256
7c78edd54d043b9ac2d4556c10f7bd07f4dd2258fd46a0f6469200431f8a21a0
-
SHA512
921797a79bb863432aa9b635e4f144678836eff9ec3a0cf31d6aad5805018b5abe8f6dd2fa830f72a3fdcd77c0ce112becf0d13cefb0119c5c96f63d2be3744d
-
SSDEEP
3072:LIvTbyuUBoAlsYJ7OcrFZrvjKP60cq/ehN8zuUQr2jRIpzgD7ZKDwodfKdM9:iylsYJ7Ocr/j1UQr2jf3ZKswU
Malware Config
Extracted
Family
xworm
C2
ensure-manual.gl.at.ply.gg:41199
Attributes
-
Install_directory
%AppData%
-
install_file
dllhost.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x00050000000447ac-6.dat family_xworm behavioral1/memory/3028-23-0x0000000000320000-0x0000000000336000-memory.dmp family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation Dragon.exe -
Executes dropped EXE 1 IoCs
pid Process 3028 Dragon.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1080 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3028 Dragon.exe Token: SeDebugPrivilege 1080 taskmgr.exe Token: SeSystemProfilePrivilege 1080 taskmgr.exe Token: SeCreateGlobalPrivilege 1080 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe 1080 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 736 wrote to memory of 3028 736 Dragon.exe 83 PID 736 wrote to memory of 3028 736 Dragon.exe 83 PID 736 wrote to memory of 4076 736 Dragon.exe 84 PID 736 wrote to memory of 4076 736 Dragon.exe 84 PID 4076 wrote to memory of 1680 4076 cmd.exe 86 PID 4076 wrote to memory of 1680 4076 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dragon.exe"C:\Users\Admin\AppData\Local\Temp\Dragon.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Roaming\Dragon.exe"C:\Users\Admin\AppData\Roaming\Dragon.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\dragon.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:1680
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1080
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1868
-
C:\Windows\System32\Bubbles.scr"C:\Windows\System32\Bubbles.scr" /S1⤵PID:3412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD553a22b4902f3b98f3520a5ded2c98e04
SHA1487c5b7f0d2fa11a68155406d67129c37e7c2a70
SHA25664e409b3bc596cec8e7fda89a2bbf7b74fcc257544a8f999b7753bbebe47245a
SHA512f2cef4ae06ffc9e62d81a6c46a6a58c6c155f544b0e58771d84b7dac08f6e2d6546722d1bbfefbd9a3e5a70e10c45f984c39c3c42dbcdf77db49ff35cf4a8f99
-
Filesize
2KB
MD5b942ff88a54c0d0777addfb9b1d93f3e
SHA1e8c800e0bca11c9c55f18e48be769a550be7840b
SHA25645db70e76ba8e7d6e12ac548be6575757d43c56d78dbd0e3497f2b5c20c21979
SHA512c707fa393917e21df77fc5147f39ac0d1a2d12479cc2752f4e3022308f4b079329271b2cbe6c0a00e15fa46561730a8c34bf472630b26d7ca1cd7e834b416aa2