Analysis Overview
SHA256
bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895
Threat Level: Known bad
The file bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe was found to be: Known bad.
Malicious Activity Summary
StormKitty payload
Xworm
Detect Xworm Payload
StormKitty
Latentbot family
LatentBot
Xworm family
Stormkitty family
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Reads user/profile data of web browsers
Suspicious use of SetThreadContext
Program crash
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Scheduled Task/Job: Scheduled Task
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-07 03:09
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-07 03:09
Reported
2024-11-07 03:12
Platform
win7-20240903-en
Max time kernel
118s
Max time network
148s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
LatentBot
Latentbot family
StormKitty
StormKitty payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Stormkitty family
Xworm
Xworm family
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Reads user/profile data of web browsers
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1940 set thread context of 2572 | N/A | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe |
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe
"C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DxVTeXwK.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DxVTeXwK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCC44.tmp"
C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe
"C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | weidmachane.zapto.org | udp |
| BG | 87.120.113.131:7000 | weidmachane.zapto.org | tcp |
| BG | 87.120.113.131:7000 | weidmachane.zapto.org | tcp |
| BG | 87.120.113.131:7000 | weidmachane.zapto.org | tcp |
Files
memory/1940-0-0x000000007413E000-0x000000007413F000-memory.dmp
memory/1940-1-0x0000000000F00000-0x0000000000F7A000-memory.dmp
memory/1940-2-0x0000000074130000-0x000000007481E000-memory.dmp
memory/1940-3-0x0000000000540000-0x000000000055C000-memory.dmp
memory/1940-4-0x000000007413E000-0x000000007413F000-memory.dmp
memory/1940-5-0x0000000074130000-0x000000007481E000-memory.dmp
memory/1940-6-0x0000000000430000-0x0000000000480000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpCC44.tmp
| MD5 | 14be0c35a5df9d9c67e17aca58a148f5 |
| SHA1 | e47740e8ca02af330acdf675361f1ad67e6810ff |
| SHA256 | 544eb5b5f4e30d14ce71a0a5e0e5150cce6d05602d753f07ed98a44eb565183d |
| SHA512 | 65f349b4d49ef476e4c18eb09256e6d8e9187de0c0e23f2a12542b8675e40ba6fb9119282981df3cfb3e5a3f516804910b5926718a52842197f1a911c352c241 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MEX1TO3AD9GX4EL9TYLC.temp
| MD5 | af6a3909fb1b9416eccea8cdcf1fc037 |
| SHA1 | 0305e513442a79f42b01ae9efe9fb2b86d38ab4a |
| SHA256 | 7ea41cba64aed68ab0f2a4c3728722b831bfd8adc9082985c3fc8519234ee714 |
| SHA512 | 41ef7400b4f46a43c320a96061de6e6149c1750a40639181299ac52bfc647898fe0b89e271e3d89259601d75ebef10ddd754f33a5d598e177fdb95333098843c |
memory/2572-28-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2572-31-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2572-29-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2572-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2572-25-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2572-23-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2572-20-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2572-21-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1940-32-0x0000000074130000-0x000000007481E000-memory.dmp
memory/2572-33-0x00000000065F0000-0x0000000006710000-memory.dmp
memory/2572-34-0x0000000000B50000-0x0000000000B5E000-memory.dmp
memory/2572-58-0x0000000008040000-0x0000000008390000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-07 03:09
Reported
2024-11-07 03:12
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
151s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
LatentBot
Latentbot family
StormKitty
StormKitty payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Stormkitty family
Xworm
Xworm family
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe | N/A |
Reads user/profile data of web browsers
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1300 set thread context of 952 | N/A | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe |
Browser Information Discovery
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe
"C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DxVTeXwK.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DxVTeXwK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6481.tmp"
C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe
"C:\Users\Admin\AppData\Local\Temp\bd749917837b3e6a48c15277cb0d5b39fd0c89e4f52be26a72e30b11816fc895.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 952 -ip 952
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 1632
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.117.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | weidmachane.zapto.org | udp |
| BG | 87.120.113.131:7000 | weidmachane.zapto.org | tcp |
| US | 8.8.8.8:53 | 131.113.120.87.in-addr.arpa | udp |
| BG | 87.120.113.131:7000 | weidmachane.zapto.org | tcp |
| BG | 87.120.113.131:7000 | weidmachane.zapto.org | tcp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
memory/1300-0-0x00000000744DE000-0x00000000744DF000-memory.dmp
memory/1300-1-0x0000000000F10000-0x0000000000F8A000-memory.dmp
memory/1300-2-0x0000000005E80000-0x0000000006424000-memory.dmp
memory/1300-3-0x00000000058D0000-0x0000000005962000-memory.dmp
memory/1300-5-0x0000000005B50000-0x0000000005BEC000-memory.dmp
memory/1300-4-0x0000000005840000-0x000000000584A000-memory.dmp
memory/1300-6-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/1300-7-0x00000000059A0000-0x00000000059BC000-memory.dmp
memory/1300-8-0x00000000744DE000-0x00000000744DF000-memory.dmp
memory/1300-9-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/1300-10-0x0000000003200000-0x0000000003250000-memory.dmp
memory/804-15-0x00000000047E0000-0x0000000004816000-memory.dmp
memory/804-16-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/804-17-0x0000000004E50000-0x0000000005478000-memory.dmp
memory/804-18-0x00000000744D0000-0x0000000074C80000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp6481.tmp
| MD5 | a90390dad73f0f07cb228fbcb5937035 |
| SHA1 | 7e5801678fa9c11627fb32173c1c31b90936452c |
| SHA256 | 56f2d4cda64bc50eb298ff9da3941b6fbca3eb0534ecb46e327ff17c6aac8674 |
| SHA512 | f1c77b4e74c9259583b51b776c4220c74a1d4e8e97999feddfc634f7eb6b1fedf7db361785e2e092640ac4bb6494328bc0f823061706d3ddd13e8f70c1a7d87b |
memory/804-19-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/3636-21-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/952-23-0x0000000000400000-0x000000000040E000-memory.dmp
memory/3636-30-0x0000000005670000-0x00000000056D6000-memory.dmp
memory/3636-29-0x0000000005590000-0x00000000055F6000-memory.dmp
memory/1300-41-0x00000000744D0000-0x0000000074C80000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uijnijh4.e1z.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/804-46-0x0000000005860000-0x0000000005BB4000-memory.dmp
memory/804-22-0x00000000055B0000-0x00000000055D2000-memory.dmp
memory/804-47-0x0000000005D20000-0x0000000005D3E000-memory.dmp
memory/804-48-0x0000000005D70000-0x0000000005DBC000-memory.dmp
memory/3636-50-0x0000000074D60000-0x0000000074DAC000-memory.dmp
memory/3636-49-0x0000000006E20000-0x0000000006E52000-memory.dmp
memory/804-61-0x0000000074D60000-0x0000000074DAC000-memory.dmp
memory/3636-60-0x0000000006240000-0x000000000625E000-memory.dmp
memory/3636-71-0x0000000006E70000-0x0000000006F13000-memory.dmp
memory/3636-72-0x00000000075E0000-0x0000000007C5A000-memory.dmp
memory/3636-73-0x0000000006FA0000-0x0000000006FBA000-memory.dmp
memory/804-74-0x00000000070E0000-0x00000000070EA000-memory.dmp
memory/804-75-0x00000000072F0000-0x0000000007386000-memory.dmp
memory/804-76-0x0000000007270000-0x0000000007281000-memory.dmp
memory/804-77-0x00000000072A0000-0x00000000072AE000-memory.dmp
memory/3636-78-0x00000000071E0000-0x00000000071F4000-memory.dmp
memory/804-79-0x00000000073B0000-0x00000000073CA000-memory.dmp
memory/3636-80-0x00000000072C0000-0x00000000072C8000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 968cb9309758126772781b83adb8a28f |
| SHA1 | 8da30e71accf186b2ba11da1797cf67f8f78b47c |
| SHA256 | 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a |
| SHA512 | 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 8761c17da183c5630e5863939822a0d5 |
| SHA1 | a4882b0a2d6a7977a04b9b45ba6cd71a29188bae |
| SHA256 | d476e8dcb50ce66f62938233c9b3254f5b17134522748115b611f116d6eaf2f8 |
| SHA512 | 4b148bbc27d2321b45fa839b86c2ad30640d3d2fc814dd14e344b1c8ed908222f1eeccaf1708bbc36fb893591e68ae31725254cde2a701ce6bf61cd72de1429a |
memory/3636-86-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/804-87-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/952-88-0x0000000007DF0000-0x0000000008140000-memory.dmp
memory/952-89-0x0000000008760000-0x0000000008880000-memory.dmp
memory/952-91-0x0000000008880000-0x0000000008BD4000-memory.dmp
memory/952-90-0x0000000001180000-0x000000000118E000-memory.dmp
memory/952-92-0x0000000008DE0000-0x0000000008E2C000-memory.dmp