Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    04-11-2024 16:40

General

  • Target

    mygame.exe

  • Size

    137KB

  • MD5

    1a925fce50787a5028b73dd32e0c7dce

  • SHA1

    7205d5c3d7efbc5805eb0b343a1bc83903e7589c

  • SHA256

    00956e3a55867b348d29da5f04cf6fb51e85872389ce6dc5f4015a958c575fb3

  • SHA512

    ceec3fa381bbcb32fb520b876fac67defc2712fcf7dcbf4a69d50a227c8f81f1cbb3aac03fc0f2ac007105b9b378c5a1c405ec2b326bf284795c0ae0e85d93a8

  • SSDEEP

    3072:6fjh7Fv9fjOwiBz65/M6If+3Js+3JFkKeTno:8hJv9AxBt25

Malware Config

Extracted

Family

xworm

Version

5.0

C2

147.185.221.23:48450

Mutex

2YsFPOHVMLfmF9px

Attributes
  • Install_directory

    %AppData%

  • install_file

    Update.exe

aes.plain

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\mygame.exe
    "C:\Users\Admin\AppData\Local\Temp\mygame.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mygame.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mygame.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2724
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Update.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2904
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Update.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2636
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Update" /tr "C:\Users\Admin\AppData\Roaming\Update.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2684
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {8699B8B3-7170-4412-B425-12F1850B0CFE} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\Users\Admin\AppData\Roaming\Update.exe
      C:\Users\Admin\AppData\Roaming\Update.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1948
    • C:\Users\Admin\AppData\Roaming\Update.exe
      C:\Users\Admin\AppData\Roaming\Update.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    e554e42e963ad2467e9f9a9a79ff4363

    SHA1

    52e46ab0f9c0f3bca92ef7540f34291b18608e38

    SHA256

    68d401e9157d87b3278d8bd255e694ee62fe02ced636127dac56a0d99de54ecd

    SHA512

    ee7666af4ee889e255cc17753223080c63e8853edc38b644bd5b18c027db872b343577629b9bd66e3542ffbea2776765d0dce5e3e39a66d148922edfb1ca200d

  • C:\Users\Admin\AppData\Roaming\Update.exe

    Filesize

    137KB

    MD5

    1a925fce50787a5028b73dd32e0c7dce

    SHA1

    7205d5c3d7efbc5805eb0b343a1bc83903e7589c

    SHA256

    00956e3a55867b348d29da5f04cf6fb51e85872389ce6dc5f4015a958c575fb3

    SHA512

    ceec3fa381bbcb32fb520b876fac67defc2712fcf7dcbf4a69d50a227c8f81f1cbb3aac03fc0f2ac007105b9b378c5a1c405ec2b326bf284795c0ae0e85d93a8

  • memory/1948-37-0x0000000000DB0000-0x0000000000DD8000-memory.dmp

    Filesize

    160KB

  • memory/2180-32-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

    Filesize

    4KB

  • memory/2180-1-0x0000000000D60000-0x0000000000D88000-memory.dmp

    Filesize

    160KB

  • memory/2180-40-0x0000000000B10000-0x0000000000B1C000-memory.dmp

    Filesize

    48KB

  • memory/2180-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

    Filesize

    4KB

  • memory/2180-33-0x000000001B2D0000-0x000000001B350000-memory.dmp

    Filesize

    512KB

  • memory/2180-31-0x000000001B2D0000-0x000000001B350000-memory.dmp

    Filesize

    512KB

  • memory/2552-7-0x000000001B670000-0x000000001B952000-memory.dmp

    Filesize

    2.9MB

  • memory/2552-8-0x0000000002040000-0x0000000002048000-memory.dmp

    Filesize

    32KB

  • memory/2552-6-0x0000000002B90000-0x0000000002C10000-memory.dmp

    Filesize

    512KB

  • memory/2724-15-0x0000000001E10000-0x0000000001E18000-memory.dmp

    Filesize

    32KB

  • memory/2724-14-0x000000001B6B0000-0x000000001B992000-memory.dmp

    Filesize

    2.9MB