Analysis
- max time kernel
133s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
05/11/2024, 10:11
General
- Target d8c874b2f3101b888c0307a3135326263d65665adf93e5cada122c765a054adc.exe
- Size 158KB
- Sample241105-l7zf8azepp
- SHA256 d8c874b2f3101b888c0307a3135326263d65665adf93e5cada122c765a054adc
Malware Config
Extracted
-
xworm
-
xxxx.freedynamicdns.net:1997
-
Install_directory
%LocalAppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot7470132733:AAFv29agMHCbkbiHbNHt7LzTib-Els5808o/sendMessage?chat_id=761641337
Signatures
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8c874b2f3101b888c0307a3135326263d65665adf93e5cada122c765a054adc.exe"C:\Users\Admin\AppData\Local\Temp\d8c874b2f3101b888c0307a3135326263d65665adf93e5cada122c765a054adc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 17562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1640 -ip 16401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1640-0-0x0000000074A6E000-0x0000000074A6F000-memory.dmp
memory/1640-1-0x00000000001E0000-0x000000000020E000-memory.dmp
memory/1640-2-0x0000000004C10000-0x0000000004CAC000-memory.dmp
memory/1640-3-0x0000000004B60000-0x0000000004B78000-memory.dmp
memory/1640-4-0x0000000074A60000-0x0000000075210000-memory.dmp
memory/1640-5-0x0000000004BC0000-0x0000000004BDA000-memory.dmp
memory/1640-6-0x0000000005230000-0x0000000005296000-memory.dmp
memory/1640-7-0x0000000074A60000-0x0000000075210000-memory.dmp