Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    14-11-2024 03:16

General

  • Target

    e9cb28657a6dcd7e0f17f6e4f7d128351c389784bb027fdaba7f669794edc846.exe

  • Size

    444KB

  • MD5

    73c088a54fd675be63ae50e1415bce9b

  • SHA1

    968ca108ce1d803f69cc3e1833d6d56615342169

  • SHA256

    e9cb28657a6dcd7e0f17f6e4f7d128351c389784bb027fdaba7f669794edc846

  • SHA512

    109d80075631fae4a952b972073677aafdb8b6c70d7e6ac1add6d6bfb5bee9a5227c3691d229a70ac67b993f37464b89efaf87b62f6646b135311e04419f9c09

  • SSDEEP

    6144:IhuPcWqUsvDuKolyqL1eLBXziQZm07wGj386cDrWTAdjiutNNStXL297RDc+BwZI:IMyUsbuKwmFifywGWBPNStyxRDc+S

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

QTumvC8IOVGR3m18

Attributes
  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/nV1XKCv3

aes.plain

Signatures

  • Detect Xworm Payload 5 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9cb28657a6dcd7e0f17f6e4f7d128351c389784bb027fdaba7f669794edc846.exe
    "C:\Users\Admin\AppData\Local\Temp\e9cb28657a6dcd7e0f17f6e4f7d128351c389784bb027fdaba7f669794edc846.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\Windows Security Health Host.exe,"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2212
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 8
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2972
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\Windows Security Health Host.exe,"
        3⤵
        • Modifies WinLogon for persistence
        • System Location Discovery: System Language Discovery
        PID:2828
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 9 > nul && copy "C:\Users\Admin\AppData\Local\Temp\e9cb28657a6dcd7e0f17f6e4f7d128351c389784bb027fdaba7f669794edc846.exe" "C:\Users\Admin\Music\Windows Security Health Host.exe" && ping 127.0.0.1 -n 9 > nul && "C:\Users\Admin\Music\Windows Security Health Host.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 9
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2948
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 9
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2912
      • C:\Users\Admin\Music\Windows Security Health Host.exe
        "C:\Users\Admin\Music\Windows Security Health Host.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2804
        • C:\Users\Admin\Music\Windows Security Health Host.exe
          "C:\Users\Admin\Music\Windows Security Health Host.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\Music\Windows Security Health Host.exe

    Filesize

    444KB

    MD5

    73c088a54fd675be63ae50e1415bce9b

    SHA1

    968ca108ce1d803f69cc3e1833d6d56615342169

    SHA256

    e9cb28657a6dcd7e0f17f6e4f7d128351c389784bb027fdaba7f669794edc846

    SHA512

    109d80075631fae4a952b972073677aafdb8b6c70d7e6ac1add6d6bfb5bee9a5227c3691d229a70ac67b993f37464b89efaf87b62f6646b135311e04419f9c09

  • memory/2700-19-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2700-31-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2700-30-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2700-28-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2700-25-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2700-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2700-23-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2700-21-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2804-17-0x0000000000740000-0x000000000075A000-memory.dmp

    Filesize

    104KB

  • memory/2804-18-0x0000000004100000-0x0000000004106000-memory.dmp

    Filesize

    24KB

  • memory/2804-16-0x0000000000AA0000-0x0000000000AE2000-memory.dmp

    Filesize

    264KB

  • memory/2804-15-0x0000000000890000-0x0000000000906000-memory.dmp

    Filesize

    472KB

  • memory/2820-0-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

    Filesize

    4KB

  • memory/2820-4-0x0000000074D40000-0x000000007542E000-memory.dmp

    Filesize

    6.9MB

  • memory/2820-3-0x00000000003C0000-0x0000000000402000-memory.dmp

    Filesize

    264KB

  • memory/2820-2-0x0000000074D40000-0x000000007542E000-memory.dmp

    Filesize

    6.9MB

  • memory/2820-1-0x0000000001140000-0x00000000011B6000-memory.dmp

    Filesize

    472KB