a6659e559b928d89655602db75505f7b1c765a11ba7af66f1cee9c9d02149562

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2024, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CefSharp.exe
Size 10.8MB
Sample241130-dy7r8strfl
SHA256 5cae75e6d6a6b249b2d977158998aaa514b8c917c313b5a0609c7b90b075ae50
MD5 acff16b9fae109888d772998b91ccca4
SHA1 b580c68d4d2bf3cc26393728337278f190d405f1
SHA512 557aadc06ca2a961ca44b6e4f46cbe412d605dab2092bee16118baaa8a4a02eecbd746ba615d0af9eddd38ed67d81ef44dd1313956a32a4798a4018d24377962
SSDEEP 196608:4gavfJVzbFUbwD5PVO47xgO2JC85cikjYA/cmiV7ZNt/ikyM:hIhBbFUcBVO47xg/C3P/eJVyM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	CefSharp.exe

Executes dropped EXE 2 IoCs

pid	Process
4688	evbA5B8.tmp
4672	xwormv5.exe

Loads dropped DLL 1 IoCs

pid	Process
2452	CefSharp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2452 set thread context of 4688	2452	CefSharp.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	xwormv5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	xwormv5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	xwormv5.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CefSharp.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4688	evbA5B8.tmp
4688	evbA5B8.tmp
4688	evbA5B8.tmp
4688	evbA5B8.tmp
4688	evbA5B8.tmp
4688	evbA5B8.tmp

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4688	2452	CefSharp.exe	82
PID 2452 wrote to memory of 4672	2452	CefSharp.exe	83
PID 2452 wrote to memory of 4672	2452	CefSharp.exe	83

C:\Users\Admin\AppData\Local\Temp\CefSharp.exe
"C:\Users\Admin\AppData\Local\Temp\CefSharp.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\evbA5B8.tmp
  "C:\Users\Admin\AppData\Local\Temp\xwormbin.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Users\Admin\AppData\Local\Temp\xwormv5.exe
  "C:\Users\Admin\AppData\Local\Temp\xwormv5.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

evbA50B.tmp

Path C:\Users\Admin\AppData\Local\Temp\evbA50B.tmp
Size 1KB
SHA256 21e178a283f66f767540ca84c2f2fe46bfe18add60a41f49a65ac4bdaae1f7a2
MD5 8fd1d495b09695f4fb95638213559464
SHA1 8525bec9fcc14bfb53145f339b5498c7d5948563
SHA512 80239f149715fccd6e0d615ace999b483315ec9451664352aea5953a321435964757721e5694e4dfbb3b8aab001621112332617b99eb95994d616160838a82a4
MD5 SHA1 SHA512

Submit Download

evbA5B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\evbA5B8.tmp
Size 1KB
SHA256 eef04cd51ee4cffc01ea5b13e1bf7a174cc4f093aef143471a31d16e20f9e280
MD5 86d23632843c402a3a34828bb99317c9
SHA1 ee7082dcee56cb61d0cae037078efb2a4b32eaae
SHA512 9a5fcf3158c96be1a48dff04d58ec15471d69f44a6a06ea5f2fcd2c858bd974bbfbfe31028cc85a321ae55f5d621038c5234dcf01757682c399b91dc007cb223
MD5 SHA1 SHA512

Submit Download

xwormv5.exe

Path \??\c:\users\admin\appdata\local\temp\xwormv5.exe
Size 14.9MB
SHA256 19f9f28a04878d8a958835f5add563c1db48498309982afea1c2fd8a7ed8cc05
MD5 6c59ff494f131d6e12eec38f2b0c4c55
SHA1 555c547cf314c867a71464b5b761c7f1d296df15
SHA512 f7a2d52aeea60d8d934bf042709bc3d00e224d0761480475609044dcd339e5927b546d51b2b23144074a70c76b64468a7b94246c254c63b5e5b1b44276cfd24f
SSDEEP 196608:64/BAe1d4ihvy85JhhYc3BSL1kehn4injeD:6uyIhhkRka4iC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2452-29-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-30-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-8-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-7-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-4-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-11-0x00000000047E0000-0x0000000004E21000-memory.dmp

Download

memory/2452-14-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-3-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-28-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-6-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-2-0x00007FFA6698D000-0x00007FFA6698E000-memory.dmp

Download

memory/2452-0-0x0000000140000000-0x00000001400DE000-memory.dmp

Download

memory/2452-31-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-5-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-34-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-33-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-36-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-35-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-44-0x00000000047E0000-0x0000000004E21000-memory.dmp

Download

memory/2452-46-0x0000000140000000-0x00000001400DE000-memory.dmp

Download

memory/2452-43-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/2452-38-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

Download

memory/4672-48-0x00000204D81F0000-0x00000204D90D8000-memory.dmp

Download

memory/4672-49-0x00000204F5580000-0x00000204F5774000-memory.dmp

Download

memory/4688-39-0x0000000140000000-0x0000000140641000-memory.dmp

Download

memory/4688-40-0x0000000000050000-0x00000000000F3000-memory.dmp

Download

memory/4688-41-0x00007FF9E6AF0000-0x00007FF9E6B00000-memory.dmp

Download

memory/4688-20-0x0000000000110000-0x0000000000111000-memory.dmp

Download