Analysis
-
max time kernel
322s -
max time network
303s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-11-2024 01:38
General
-
Target
Bloxstrap-v2.8.1.exe
-
Size
90KB
-
MD5
14d4016a97613c132cd0f5ef44bb89e5
-
SHA1
6bf013a301f5f18f4948806392f06552295cc71e
-
SHA256
05e8795cc1a3970c8f1175f05f013caffca9feecb7e53bff65c478b94c4fc722
-
SHA512
c0279b287cadc4cf97a454632a9161fd2ca24884e6e9ad8997b92f1781d5a17d137001828c924bc685d1f0ae997a0797189d818ead6d45ea13b20ce58b7329d4
-
SSDEEP
1536:0svC6eOgCMFU9YAOMH+HVFHwMuz8bkX0L9qrtOg3tzQUB/dP3/PKx5eClbm:00reOgJFU9YAOMenHwKkX0BsQEzQsPKG
Malware Config
Extracted
xworm
5.0
127.0.0.1:7000
VbFWnnjtfbUcjrCO
-
Install_directory
%LocalAppData%
-
install_file
FileExplorer.exe
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Drops startup file 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 36 IoCs
-
Suspicious use of SendNotifyMessage 36 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.8.1.exe"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.8.1.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD514d4016a97613c132cd0f5ef44bb89e5
SHA16bf013a301f5f18f4948806392f06552295cc71e
SHA25605e8795cc1a3970c8f1175f05f013caffca9feecb7e53bff65c478b94c4fc722
SHA512c0279b287cadc4cf97a454632a9161fd2ca24884e6e9ad8997b92f1781d5a17d137001828c924bc685d1f0ae997a0797189d818ead6d45ea13b20ce58b7329d4
-
Filesize
989B
MD5005d64c1f747970950a03724e4bd4515
SHA10faf3419e41718926207d1d8abe5658dbcadbb38
SHA256541e94bdbde5ed7fe6730cee39caeb7bb0cd84f4f304665bd715d8aeb2212ec7
SHA512a2300e6350c83a28fc8e8fd75ea307bb9b3bcfbb795fb7f43877c7bb36d6af6dbd529decf633b144b74b5ac568a9167a42acdf86b9cc20f1f6fff040e34684bb
-
Filesize
8KB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB