Analysis

  • max time kernel
    155s
  • max time network
    209s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    08-11-2024 20:35

General

  • Target

    be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe

  • Size

    2.4MB

  • MD5

    bdc6432b365c256c5d0efe8d66122e8f

  • SHA1

    1ca7dda606a3b2204f35e43abb68b04c97063d36

  • SHA256

    be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c

  • SHA512

    3d28acbe162b0d88f1b3ca8a034c010a973ccc05ff3f0f0a9dbb902f98924cae1bce5f1b9f20f58567669503c41e9696000fb27edda4416398f0e7aac525b767

  • SSDEEP

    49152:+2uqU+xRoatgQBJKweR4RF8gAGBJ7dj9Shv68pd3hm/F4OGP6:+2uOxRoaOQBEws4gWrhcoq3HOz

Score
10/10

Malware Config

Extracted

Family

xworm

C2

93.123.109.89:7000

Attributes
  • Install_directory

    %Temp%

  • install_file

    ApplicationFrameHost.exe

  • telegram

    https://api.telegram.org/bot7026989332:AAGmlQvBZEqqtR_5LGfdSJ8B_oJ6WH5oCYY

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe
    "C:\Users\Admin\AppData\Local\Temp\be69709414e60eae521dc4b85784bceda124959adc21b554aaa660707dbbe89c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Users\Admin\AppData\Local\Temp\Ocean.exe
      "C:\Users\Admin\AppData\Local\Temp\Ocean.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:540
      • C:\Users\Admin\AppData\Local\Temp\XQISIk\WTKPYmymaM9rpdV.exe
        C:\Users\Admin\AppData\Local\Temp\XQISIk\WTKPYmymaM9rpdV.exe 111
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2120
    • C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHost.exe
      "C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHost.exe

    Filesize

    73KB

    MD5

    59304b625ddc6fa1d95bc09cf84b2fa6

    SHA1

    e3e14f54a6471570c3e10cc257fa8bedd5492d49

    SHA256

    440e5bf83310276bef2e72668283fda8eb1e84bdf902632fe0571bfe1ba61204

    SHA512

    0309e04719424ad52b9bf07c8801ace891b8ffdc1c1f69bae7269086ef296f576bd89d9b1a70b62d4545d83b952439b12de5b17d6e51a187068dd222414ec167

  • C:\Users\Admin\AppData\Local\Temp\Ocean.exe

    Filesize

    2.3MB

    MD5

    286efca498147dedaf4169e9bb297b52

    SHA1

    a88b65dc85d209a26da56c1d31fc63edb99d0819

    SHA256

    de824109d13ae96a87c2cfabbc650e05765e1ae36ebe69c4bf16d253f3e7f53d

    SHA512

    3b4149969308e53bf4f37af4f71d47199f6ba0198fd6e9b0a937daf11c728bdf2f695aa2400c1ee0db7708ed5e48b1cce5596b7a5cce9cafa21e6de8eb5c9ad6

  • C:\Users\Admin\AppData\Local\Temp\XQISIk\WTKPYmymaM9rpdV.exe

    Filesize

    7.6MB

    MD5

    04119e6b18ad58698adf99a9ee1fce91

    SHA1

    1a1c1099bbce911df30fecb8f7f8ed78e22d0318

    SHA256

    1312fb7adee3f7dad51214e1fb78670b64177881d0e60adf74de339960da54b8

    SHA512

    7698fb2ec12291a776e9fd39648d094f62c3c8cef43b6aa900b30d520f316ead179f833b9a1df6bcfe132c637fd62282d2e31881a5f5cbd6c78c9a381d9cf00b

  • memory/836-0-0x00007FFC9E6E3000-0x00007FFC9E6E5000-memory.dmp

    Filesize

    8KB

  • memory/836-1-0x0000000000E50000-0x00000000010C2000-memory.dmp

    Filesize

    2.4MB

  • memory/1240-28-0x0000000000CE0000-0x0000000000CF8000-memory.dmp

    Filesize

    96KB

  • memory/1240-29-0x00007FFC9E6E0000-0x00007FFC9F1A2000-memory.dmp

    Filesize

    10.8MB

  • memory/1240-30-0x00007FFC9E6E0000-0x00007FFC9F1A2000-memory.dmp

    Filesize

    10.8MB

  • memory/2120-35-0x00007FFCBCF10000-0x00007FFCBCF12000-memory.dmp

    Filesize

    8KB

  • memory/2120-36-0x00007FFCBCF20000-0x00007FFCBCF22000-memory.dmp

    Filesize

    8KB

  • memory/2120-38-0x0000000140000000-0x000000014169A000-memory.dmp

    Filesize

    22.6MB