Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-12-2024 23:08
General
-
Target
ss32.exe
-
Size
94KB
-
MD5
cbe1be5547cc26f924d6fa48b4abca92
-
SHA1
972f9afdb39425a4764be0a91552613e49eba7f3
-
SHA256
549565dab31274ecd5370f02766116260e56390b405231ddaf3a7186395f1d9f
-
SHA512
be567464ab80a4c00f7b499c1b645cf2ef301242a5feffad1b6dca8b2281f066a9f0ae63fbf8715c3e3c3b0dc6c8e1093d057ff245c5de5f8b39da37eb56a272
-
SSDEEP
1536:GW4ZYDn38RoEv9fEonXRyoZX7rhC5Hg4P0lALoVrZ+hR40qvUusn47k:GW4Zs38pvBXn/nhgHg43LsUnqMusn47k
Malware Config
Extracted
xworm
SLL.casacam.net:4444
-
Install_directory
%LocalAppData%
-
install_file
Interrupi.exe
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ss32.exe"C:\Users\Admin\AppData\Local\Temp\ss32.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Interrupi" /tr "C:\Users\Admin\AppData\Local\Interrupi.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Interrupi.exeC:\Users\Admin\AppData\Local\Interrupi.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Interrupi.exeC:\Users\Admin\AppData\Local\Interrupi.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Interrupi.exeC:\Users\Admin\AppData\Local\Interrupi.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5cbe1be5547cc26f924d6fa48b4abca92
SHA1972f9afdb39425a4764be0a91552613e49eba7f3
SHA256549565dab31274ecd5370f02766116260e56390b405231ddaf3a7186395f1d9f
SHA512be567464ab80a4c00f7b499c1b645cf2ef301242a5feffad1b6dca8b2281f066a9f0ae63fbf8715c3e3c3b0dc6c8e1093d057ff245c5de5f8b39da37eb56a272
-
Filesize
660B
MD51c5e1d0ff3381486370760b0f2eb656b
SHA1f9df6be8804ef611063f1ff277e323b1215372de
SHA256f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
SHA51278f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
120KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
80KB
-
Filesize
8KB
-
Filesize
10.8MB