Analysis
-
max time kernel
55s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-11-2024 13:51
General
-
Target
MEMORY CODE STEALER FROM EXE.exe
-
Size
1.2MB
-
MD5
e9484520c0af2af421fc682c1e757c76
-
SHA1
423650cf9f48cf8cdaaac4ed9b5362eadbd0ce90
-
SHA256
1e2e67e75639830b4e39698bd9c7679d64393b435ab38fc8f07926f7ba36636b
-
SHA512
099f04bf9fa854eab58d3ec1121f47b2af326bfb560cd14cfb0ad439e0ab575ded05a164ed4a130e0a19c4d1e521f0fa3b0277114f088c7f607e4d4c1b359fa7
-
SSDEEP
24576:BwRW7N5+l5c/PNRDtual8WDSBHkiEToNkuPpVQN561xtDNwt:BwE7N565SPNRDYqfDSBLwShPAN5c3DK
Malware Config
Extracted
xworm
147.185.221.21:27938
-
Install_directory
%Userprofile%
-
install_file
svchost.exe
-
telegram
https://api.telegram.org/bot6575053517:AAHfQSqLTvzOajvn1QldlaGUVj-u9hK2upc/sendMessage?chat_id=7492036336
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEMORY CODE STEALER FROM EXE.exe"C:\Users\Admin\AppData\Local\Temp\MEMORY CODE STEALER FROM EXE.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\MEMORY CODE STEALER FROM EXE.exe"C:\Users\Admin\MEMORY CODE STEALER FROM EXE.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\svchost.exe"C:\Users\Admin\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d071e8ffbd98a93dde7435f787416897
SHA11ba077c30bfd6622afb06bd1f864cd61caf5059c
SHA256e3c292de83fccffbe2ad53286410b7ee1eea3a73caae9d97f28b582089ad7a86
SHA5126764f358a817c25309a346581a58374e9f96f44b507e96903010f755b73df923b754386b3edcf1aaf229d1c7432459b51dfb89d33fb591be6f7231b51aad8f05
-
Filesize
77KB
MD57a663541653efa34e7e2aabf0acf6ada
SHA1ae14101f62220e6435ed3d80e03dbb4e5f29b344
SHA256829016d508f4064cc618eef8c9250ad000b15355ce563f172e6e54f776c74f9c
SHA5127267f6b0c41dff35a761171a30ebdfde83e81a29f4511fe808cb28b0d7d0a2a2b101fac57aefe74b9c8475ae37c87471b8dcedf1e9458da5dd8d839270a20508
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
10.8MB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
856KB
-
Filesize
10.8MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
72KB
-
Filesize
104KB
-
Filesize
10.8MB