Analysis
-
max time kernel
286s -
max time network
297s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-12-2024 16:30
Static task
static1
Behavioral task
behavioral1
Sample
VixenLoader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
VixenLoader.exe
Resource
win10v2004-20241007-en
General
-
Target
VixenLoader.exe
-
Size
38.3MB
-
MD5
42660a451f750c72df213ed8b234da84
-
SHA1
57d610944313b20cec5918d8e4a482eebbe45beb
-
SHA256
6d2cf58460eeebc417121afd3d5b0592b88b16f1b115e16aba32049437d05832
-
SHA512
3843a449128f6be9ec4cfaee84c6c9c323b79bdfd22c9cf582c7f563c125db66fd12ae9324af197265e0da6faf30cb2a5a9e966c9343d9d098b0a8a38c655526
-
SSDEEP
786432:73skHahOcCzPA18A/Fk+SfyNqDOjM8VzG4j9rL5nUbVOtsa:zmhQ4iA/eVrCtzGoZ1Ug
Malware Config
Extracted
xworm
5.0
play-treatments.gl.at.ply.gg:50330
0JSF3VLcLKVr7CJP
-
Install_directory
%ProgramData%
-
install_file
System.exe
Signatures
-
Detect Xworm Payload 5 IoCs
resource yara_rule behavioral1/files/0x00070000000156b5-7.dat family_xworm behavioral1/memory/1192-21-0x0000000000DC0000-0x0000000000DD0000-memory.dmp family_xworm behavioral1/memory/1108-106-0x00000000008C0000-0x00000000008D0000-memory.dmp family_xworm behavioral1/memory/376-109-0x0000000001150000-0x0000000001160000-memory.dmp family_xworm behavioral1/memory/1292-112-0x00000000011A0000-0x00000000011B0000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2608 powershell.exe 2732 powershell.exe 3000 powershell.exe 464 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk System.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk System.exe -
Executes dropped EXE 8 IoCs
pid Process 2812 Registry.exe 1192 System.exe 2828 Stub.exe 1108 System.exe 376 System.exe 2548 System.exe 1292 System.exe 1540 System.exe -
Loads dropped DLL 4 IoCs
pid Process 3028 VixenLoader.exe 3028 VixenLoader.exe 2812 Registry.exe 2828 Stub.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\ProgramData\\System.exe" System.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VixenLoader.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 756 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2608 powershell.exe 2732 powershell.exe 3000 powershell.exe 464 powershell.exe 1192 System.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 1192 System.exe Token: SeDebugPrivilege 2608 powershell.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 3000 powershell.exe Token: SeDebugPrivilege 464 powershell.exe Token: SeDebugPrivilege 1192 System.exe Token: SeDebugPrivilege 1108 System.exe Token: SeDebugPrivilege 376 System.exe Token: SeDebugPrivilege 2548 System.exe Token: SeDebugPrivilege 1292 System.exe Token: SeDebugPrivilege 1540 System.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1192 System.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2812 3028 VixenLoader.exe 30 PID 3028 wrote to memory of 2812 3028 VixenLoader.exe 30 PID 3028 wrote to memory of 2812 3028 VixenLoader.exe 30 PID 3028 wrote to memory of 2812 3028 VixenLoader.exe 30 PID 3028 wrote to memory of 1192 3028 VixenLoader.exe 31 PID 3028 wrote to memory of 1192 3028 VixenLoader.exe 31 PID 3028 wrote to memory of 1192 3028 VixenLoader.exe 31 PID 3028 wrote to memory of 1192 3028 VixenLoader.exe 31 PID 2812 wrote to memory of 2828 2812 Registry.exe 32 PID 2812 wrote to memory of 2828 2812 Registry.exe 32 PID 2812 wrote to memory of 2828 2812 Registry.exe 32 PID 1192 wrote to memory of 2608 1192 System.exe 33 PID 1192 wrote to memory of 2608 1192 System.exe 33 PID 1192 wrote to memory of 2608 1192 System.exe 33 PID 1192 wrote to memory of 2732 1192 System.exe 35 PID 1192 wrote to memory of 2732 1192 System.exe 35 PID 1192 wrote to memory of 2732 1192 System.exe 35 PID 1192 wrote to memory of 3000 1192 System.exe 37 PID 1192 wrote to memory of 3000 1192 System.exe 37 PID 1192 wrote to memory of 3000 1192 System.exe 37 PID 1192 wrote to memory of 464 1192 System.exe 39 PID 1192 wrote to memory of 464 1192 System.exe 39 PID 1192 wrote to memory of 464 1192 System.exe 39 PID 1192 wrote to memory of 756 1192 System.exe 41 PID 1192 wrote to memory of 756 1192 System.exe 41 PID 1192 wrote to memory of 756 1192 System.exe 41 PID 2420 wrote to memory of 1108 2420 taskeng.exe 45 PID 2420 wrote to memory of 1108 2420 taskeng.exe 45 PID 2420 wrote to memory of 1108 2420 taskeng.exe 45 PID 2420 wrote to memory of 376 2420 taskeng.exe 46 PID 2420 wrote to memory of 376 2420 taskeng.exe 46 PID 2420 wrote to memory of 376 2420 taskeng.exe 46 PID 2420 wrote to memory of 2548 2420 taskeng.exe 47 PID 2420 wrote to memory of 2548 2420 taskeng.exe 47 PID 2420 wrote to memory of 2548 2420 taskeng.exe 47 PID 2420 wrote to memory of 1292 2420 taskeng.exe 48 PID 2420 wrote to memory of 1292 2420 taskeng.exe 48 PID 2420 wrote to memory of 1292 2420 taskeng.exe 48 PID 2420 wrote to memory of 1540 2420 taskeng.exe 49 PID 2420 wrote to memory of 1540 2420 taskeng.exe 49 PID 2420 wrote to memory of 1540 2420 taskeng.exe 49 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VixenLoader.exe"C:\Users\Admin\AppData\Local\Temp\VixenLoader.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\Registry.exe"C:\Users\Admin\AppData\Local\Temp\Registry.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\onefile_2812_133786674306874000\Stub.exeC:\Users\Admin\AppData\Local\Temp\Registry.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828
-
-
-
C:\Users\Admin\AppData\Local\Temp\System.exe"C:\Users\Admin\AppData\Local\Temp\System.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\System.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\System.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\ProgramData\System.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:756
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {E279806D-5DFE-434A-93B0-69D64713E7B0} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\ProgramData\System.exeC:\ProgramData\System.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
C:\ProgramData\System.exeC:\ProgramData\System.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
C:\ProgramData\System.exeC:\ProgramData\System.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
C:\ProgramData\System.exeC:\ProgramData\System.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
C:\ProgramData\System.exeC:\ProgramData\System.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5e4533934b37e688106beac6c5919281e
SHA1ada39f10ef0bbdcf05822f4260e43d53367b0017
SHA2562bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5
SHA512fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4A1F0GYWB4LQELIMUVHI.temp
Filesize7KB
MD5a2900bf5618e6dc31ac28b952c3fe21f
SHA1bfa9b1d66c6e4d4e87c74d8ad7ef918b256e4a63
SHA256b0c6fa9c6d0529016daf3a05a7928884d6c7421efed22eaeeaed323ac402fa1e
SHA5127b1fa59c11c84fda4336fedf8134d62118a87b917b5fd2409a08cf5b7d6b65fb16f2c08549b99393d43f62a2e764ec76cf4cf0d05700b39cb47c1715a3420d25
-
Filesize
38.2MB
MD5b4c97238cbd3eef2220646a06ad12d3d
SHA1448cd7706447ec684ddbdfa86298ab7ebe2b5d37
SHA2561b2e36cb8bece957248db97bae8a1ea60c606a968da4ec1b8ef7bd740a3d30ab
SHA512d823a9c84e93946b139ba771c4ab9b9a46236689f4140712d6c122517660225e9cb927dd0be79d7e4920b5cf567daf124d67ae714a99952f26434a2b887bf8cc
-
Filesize
39KB
MD5dda376d12dabb5271a3678e378fe5b11
SHA191711a77680345ef75c1ca6b0c5f46fc5afc9044
SHA256f59efc57c51f6605eed29422e8c97c0d1098d6e920a9a89957625f08785160e1
SHA5127166ad32241e4b7534cc619943369f8daf3daf8e85ff2f2ce96551ad712930bcca3db534470d435448280b342bb380a84c7d52619ccd4932ccc6b786e4ecc03f