Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 12:00
Static task
static1
Behavioral task
behavioral1
Sample
TRXLoader.exe
Resource
win7-20240903-en
General
-
Target
TRXLoader.exe
-
Size
44.0MB
-
MD5
a4b651742b17fcb894107862b5587344
-
SHA1
9fb0be5290ff4cb8a7e7a41656beb950f7718f8d
-
SHA256
3f862630ab1f165e33bdf388a4829a0274abd88ee783273f03353857c21aa9a0
-
SHA512
ba19d8bc1aa69553f1ea1ab3937e226b4664be81fa77371d093a52f23a9806e7f7e9f3f11dbec805b7ed943cb571984774c5591dbedf816c7ff05aaf7da062b3
-
SSDEEP
1536:j3eHtRfrimdNmkKZr311OGAiQj39IdcCqcAPt9TeKd+k:KHtRp6r311RAzj390VAPt9P+k
Malware Config
Extracted
xworm
127.0.0.1:38492
warning-ms.gl.at.ply.gg:38492
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000004e74-12.dat family_xworm behavioral1/memory/2888-14-0x0000000000BF0000-0x0000000000C0C000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2424 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2888 Nursultan.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2424 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2424 powershell.exe Token: SeDebugPrivilege 2888 Nursultan.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2424 2072 TRXLoader.exe 31 PID 2072 wrote to memory of 2424 2072 TRXLoader.exe 31 PID 2072 wrote to memory of 2424 2072 TRXLoader.exe 31 PID 2072 wrote to memory of 2888 2072 TRXLoader.exe 33 PID 2072 wrote to memory of 2888 2072 TRXLoader.exe 33 PID 2072 wrote to memory of 2888 2072 TRXLoader.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\TRXLoader.exe"C:\Users\Admin\AppData\Local\Temp\TRXLoader.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD538fc92faaaa97884e49674a2fb59dffa
SHA1d2fdfcd6a426e4a0eb3dfc3b1c0d09ea0db945a2
SHA25626d868f392303276bb62ce6771ec4bae63add8874e2621549d447490112ba992
SHA512b8d4a64a9e02e96848d9285b3a6e7986cf4c54a520f75354008815790d7001361b3e570d9ff1c2d5e747ee1943b6bee791012120b536b06edb534aa76c445777