Analysis
-
max time kernel
147s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 00:07
Static task
static1
Behavioral task
behavioral1
Sample
ORDER DRAWING AND PHOTOS.exe
Resource
win7-20240903-en
General
-
Target
ORDER DRAWING AND PHOTOS.exe
-
Size
2.0MB
-
MD5
395bb950d2979e4c3911d90852c06345
-
SHA1
2a693150907af200bbf8582a69e663d23249c7d0
-
SHA256
1adbc19898a40ae7f2c6fd9a6d1c502c7152ba6b04d4584e2c7476606f9b24ff
-
SHA512
d95b46177b0820f286e99f647ff398788d24502885fc2b63fe19dfb1a58d7ae15cabd2749ab00b709b37a3fb75b9ccf28628ad2f686a507fc1142486a8f32b61
-
SSDEEP
12288:xkNH+OOlsur4fwML7K6yD210eS+Fl1DkjGKUuU6Sn:mH+D+Hb3K6yD22eTl1oj1UYq
Malware Config
Extracted
xworm
5.0
weidmachane.zapto.org:7000
Y3sPpIW4xQztdVfl
-
install_file
USB.exe
Extracted
latentbot
weidmachane.zapto.org
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/800-4-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm -
Latentbot family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/800-14-0x0000000006AD0000-0x0000000006BF0000-memory.dmp family_stormkitty -
Stormkitty family
-
Xworm family
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ORDER DRAWING AND PHOTOS.exedescription pid process target process PID 4136 set thread context of 800 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 632 800 WerFault.exe AddInProcess32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AddInProcess32.exedescription pid process Token: SeDebugPrivilege 800 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ORDER DRAWING AND PHOTOS.exedescription pid process target process PID 4136 wrote to memory of 348 4136 ORDER DRAWING AND PHOTOS.exe regasm.exe PID 4136 wrote to memory of 348 4136 ORDER DRAWING AND PHOTOS.exe regasm.exe PID 4136 wrote to memory of 348 4136 ORDER DRAWING AND PHOTOS.exe regasm.exe PID 4136 wrote to memory of 800 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe PID 4136 wrote to memory of 800 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe PID 4136 wrote to memory of 800 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe PID 4136 wrote to memory of 800 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe PID 4136 wrote to memory of 800 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe PID 4136 wrote to memory of 800 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe PID 4136 wrote to memory of 800 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe PID 4136 wrote to memory of 800 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe PID 4136 wrote to memory of 3664 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe PID 4136 wrote to memory of 3664 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe PID 4136 wrote to memory of 3664 4136 ORDER DRAWING AND PHOTOS.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER DRAWING AND PHOTOS.exe"C:\Users\Admin\AppData\Local\Temp\ORDER DRAWING AND PHOTOS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵PID:348
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 15683⤵
- Program crash
PID:632 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:3664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 800 -ip 8001⤵PID:556