Overview

overview

10

Static

static

3

SRTWARE LOADER.zip

windows10-ltsc 2021-x64

1

srtware loader.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SRTWARE LOADER.zip

  • Size

    1.1MB

  • Sample

    241204-kfsnxsvmcp

  • MD5

    a2a9db38e6610e97da9a2b7fb33ef2d2

  • SHA1

    058b60241ddaacaecb93488f1d20a957fe425d84

  • SHA256

    31255113e17d320985ad1641e08b17818ddc957996c0be157f850dccec9d6011

  • SHA512

    bf41b43853680fe26461f93ac9a9703ea833e5ba3063be737664a0051dd48631c45e4587a74e2c09c73668016c44cd335aa570d94c1c92c402907521392d3118

  • SSDEEP

    24576:GtKU1NdIjQYoMtlE9iYHEkVNeehZegXZIWdSFkQobbq+WdvM588dhOFqS:GMadI0xCG7JNnhUgXvWcbq+Wdk584Q

Score
10/10
xwormcredential_accessdiscoveryexecutionpersistenceratspywarestealertrojan

Malware Config

Targets

    • Target

      SRTWARE LOADER.zip

    • Size

      1.1MB

    • MD5

      a2a9db38e6610e97da9a2b7fb33ef2d2

    • SHA1

      058b60241ddaacaecb93488f1d20a957fe425d84

    • SHA256

      31255113e17d320985ad1641e08b17818ddc957996c0be157f850dccec9d6011

    • SHA512

      bf41b43853680fe26461f93ac9a9703ea833e5ba3063be737664a0051dd48631c45e4587a74e2c09c73668016c44cd335aa570d94c1c92c402907521392d3118

    • SSDEEP

      24576:GtKU1NdIjQYoMtlE9iYHEkVNeehZegXZIWdSFkQobbq+WdvM588dhOFqS:GMadI0xCG7JNnhUgXvWcbq+Wdk584Q

    Score
    1/10
    behavioral1

    • Target

      srtware loader.exe

    • Size

      1.1MB

    • MD5

      f6f8a568173b6eb4615a4a1976e23ec0

    • SHA1

      4d1ce31764d041f6fdbb6b23dec84b9f36c038ee

    • SHA256

      18dfd072458b0742e9bf36776f86842461ebfa64ce69f48d16ac1e0c17f1d542

    • SHA512

      35fddd2f5ae9bec1326c3d6321479ce678b1cd28f0a78d1adfbeb595378ae72e7397d97a30d5f2ed170aba3f71445bc1fdaa3a039b5b0e1ad710fc4694fb7599

    • SSDEEP

      24576:kuxx2ZISuA29l1BFe6zMVg4VPQcNOtoKk1dABNRXu+gKwmf:kEx2ZuAS1B86g/VIWCVkK

    Score
    10/10
    xwormcredential_accessdiscoveryexecutionpersistenceratspywarestealertrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks