Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
03-11-2024 05:51
General
-
Target
BootStrapperV3.exe
-
Size
82KB
-
MD5
e79e1cc77eec4a9add38dbb914411216
-
SHA1
f7bf11eac6c90f7a7520330879ee346dff5d1cfb
-
SHA256
9eab83decb30d393340fb2adbdf93b8f0969e8cc5b73099abeb899b463e37d87
-
SHA512
1fa943879ec025d8fe88f6f57bcc01df22f8b8eae545c97ff1606ec340d3b220b7e070a9e7cebc7a5266447a60be1c3e292d8263ef6fe0c9868b67ab8ea4e4b7
-
SSDEEP
1536:WpdGSzNnmyBOsjojsfdTFQ5IKenwvG36aRpoybv1oShFru65E5OekMJdV7a:QpNnxoA1TS5IzwvG33bvlr5E5OekMd7a
Malware Config
Extracted
Family
xworm
C2
where-reverse.gl.at.ply.gg:18649
Attributes
-
Install_directory
%ProgramData%
-
install_file
Helper.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/1944-1-0x0000000000480000-0x000000000049A000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2640 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1944 BootStrapperV3.exe Token: SeDebugPrivilege 2640 taskmgr.exe Token: SeSystemProfilePrivilege 2640 taskmgr.exe Token: SeCreateGlobalPrivilege 2640 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BootStrapperV3.exe"C:\Users\Admin\AppData\Local\Temp\BootStrapperV3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2640