Analysis
-
max time kernel
5s -
max time network
11s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 15:40
General
-
Target
dick.exe
-
Size
38KB
-
MD5
ce2283cbadee69f3121bf2edf38d6d80
-
SHA1
a32a7bdf7efe4974ea7102de4a23ef14fa08d21a
-
SHA256
af9a1baabfe853c60867995982763b19a5cb53524930fe4e3e149349c51bcddc
-
SHA512
79ad56ebb57f86f04133d7b9786cfe93aeba422cde054795e3bdd4944d2c68f6333d83249faedb7ec4793c81eca3f2a636e9d477823c6c8be4856352786c7479
-
SSDEEP
768:W7fuHRm9lgWRWkbfcZQpEkU9OfzhBHNZHVb:qKRm0WfbfcOuHOfzf5
Malware Config
Extracted
xworm
review-monroe.gl.at.ply.gg:46169
lWfA9hbGdE2IDzRq
-
Install_directory
%AppData%
-
install_file
Mason.exe
Extracted
njrat
QUJPTEhC
ByABOLHB
abolhb.com:505
66f73d9b4e94d115b763eaa1ada7d1f1
-
reg_key
66f73d9b4e94d115b763eaa1ada7d1f1
-
splitter
|'|'|
Signatures
-
Detect Xworm Payload 1 IoCs
-
Njrat family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dick.exe"C:\Users\Admin\AppData\Local\Temp\dick.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "dick" /tr "C:\Users\Admin\AppData\Roaming\dick.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
48KB
-
Filesize
8KB