Overview

overview

10

Static

static

10

setup-9035d.exe

windows7-x64

10

setup-9035d.exe

windows10-2004-x64

Analysis

  • max time kernel
    18s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2024, 06:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    setup-9035d.exe

  • Size

    76KB

  • MD5

    433edb87db3a82d14ba7d88ba87d3503

  • SHA1

    bb2af0b83d7a55aa2d9ebd5e1d3d6f06f1fecc8c

  • SHA256

    7743183018de756ca03523c24561a2cb868fc69e63ba01f4ff854cc11c3115ba

  • SHA512

    858fe073ff5a015d4a51b8976d1e88dcb23504848fb07cc6f1cc5eeac6de91c615aa028de867f520b7bd59750f6a2633061aec96cf5766c18eda8103e16a0516

  • SSDEEP

    1536:O1e1/zEY3vnxkoig5PBVDVfEHbqZYkcJzR72eP72X4HKzkO7C7ZGhLW:Pr3fxTPLh+bYX497MCO72Y1W

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Setup-x9035d.exe

  • pastebin_url

    https://pastebin.com/raw/2zRWZhkX

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup-9035d.exe
    "C:\Users\Admin\AppData\Local\Temp\setup-9035d.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Setup-x9035d" /tr "C:\ProgramData\Setup-x9035d.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2740

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1904-0-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-1-0x00000000011F0000-0x000000000120A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/1904-2-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1904-3-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

          Filesize

          9.9MB

          Download