Analysis
-
max time kernel
210s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2024 12:56
General
-
Target
Network.exe
-
Size
82KB
-
MD5
4c69483ff0c35be5ab917fe321fcdf25
-
SHA1
40845d144583d6e06ebd1bf0e36975cc5068c669
-
SHA256
be6efed1679ba6aaaa8108b53c046101a056b110aff2218116e2fb2f5ecb5fbc
-
SHA512
9c42bd25cc2d83b306621d95e31cc2ee07742cb98cd8787dd3659ecdd4ec8885407537028cb5e36144b1b00205f4636aa231aed4aa371148400e747141c0cfc7
-
SSDEEP
1536:3mVE/FEa5mweETDXc1tJbsCLdLJQM5uM6dslOtwGCy:3mCFBeE/c5bsCZRu/slOtw4
Malware Config
Extracted
Family
xworm
Version
5.0
Attributes
-
Install_directory
%AppData%
-
install_file
NetworkEX.exe
-
pastebin_url
https://pastebin.com/raw/jGuGV3jT
-
telegram
https://api.telegram.org/bot6554307825:AAFiCM4YZlx7R1yb0K0d5pqenjePI2Nljfc/sendMessage?chat_id=6077384108
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/3636-1-0x0000000000470000-0x000000000048A000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4360 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3636 Network.exe Token: SeDebugPrivilege 4360 taskmgr.exe Token: SeSystemProfilePrivilege 4360 taskmgr.exe Token: SeCreateGlobalPrivilege 4360 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe 4360 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Network.exe"C:\Users\Admin\AppData\Local\Temp\Network.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4360