Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11-11-2024 12:00

General

  • Target

    TRXLoader.exe

  • Size

    44.0MB

  • MD5

    a4b651742b17fcb894107862b5587344

  • SHA1

    9fb0be5290ff4cb8a7e7a41656beb950f7718f8d

  • SHA256

    3f862630ab1f165e33bdf388a4829a0274abd88ee783273f03353857c21aa9a0

  • SHA512

    ba19d8bc1aa69553f1ea1ab3937e226b4664be81fa77371d093a52f23a9806e7f7e9f3f11dbec805b7ed943cb571984774c5591dbedf816c7ff05aaf7da062b3

  • SSDEEP

    1536:j3eHtRfrimdNmkKZr311OGAiQj39IdcCqcAPt9TeKd+k:KHtRp6r311RAzj390VAPt9P+k

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:38492

warning-ms.gl.at.ply.gg:38492

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TRXLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\TRXLoader.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nursultan.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2424
    • C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
      "C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Nursultan.exe

    Filesize

    87KB

    MD5

    38fc92faaaa97884e49674a2fb59dffa

    SHA1

    d2fdfcd6a426e4a0eb3dfc3b1c0d09ea0db945a2

    SHA256

    26d868f392303276bb62ce6771ec4bae63add8874e2621549d447490112ba992

    SHA512

    b8d4a64a9e02e96848d9285b3a6e7986cf4c54a520f75354008815790d7001361b3e570d9ff1c2d5e747ee1943b6bee791012120b536b06edb534aa76c445777

  • memory/2072-0-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

    Filesize

    4KB

  • memory/2072-1-0x000000013F490000-0x000000013F4B8000-memory.dmp

    Filesize

    160KB

  • memory/2424-6-0x0000000002A60000-0x0000000002AE0000-memory.dmp

    Filesize

    512KB

  • memory/2424-7-0x000000001B5A0000-0x000000001B882000-memory.dmp

    Filesize

    2.9MB

  • memory/2424-8-0x0000000001F40000-0x0000000001F48000-memory.dmp

    Filesize

    32KB

  • memory/2888-14-0x0000000000BF0000-0x0000000000C0C000-memory.dmp

    Filesize

    112KB