Analysis

  • max time kernel
    129s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 17:38

General

  • Target

    FatalityCrack.exe

  • Size

    74KB

  • MD5

    44217b6e8f45f82ebffe92321639290b

  • SHA1

    6bd7da4585d438bc28d5350b9415b6d73b32e807

  • SHA256

    657dcc3378b3dbbd131926612fb00e67683ccbc64dc2d743fce213734804f427

  • SHA512

    a68f7f194aadd63dcfad5af49dac4def19748e8fb657ab4cc06b514a1a7a2f5fb42424cb1a54a259987487558f2f2c950a1fd219a59f9b27ef826774ae27e7c8

  • SSDEEP

    1536:FNhc3BhmLTzjuReXV2y+bo0QnRr6wDeTJPovOoRnaRxsZP:1cxEWRsV2y+boveoOoRN5

Malware Config

Extracted

Family

xworm

C2

userxmorma-27072.portmap.host:27072

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot8050356849:AAGkujkVbiAoFzC-JTeiZPs5sCb3sdrY2sU/sendMessage?chat_id=8050356849

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FatalityCrack.exe
    "C:\Users\Admin\AppData\Local\Temp\FatalityCrack.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\FatalityCrack.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'FatalityCrack.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2604
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1308

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          2b1f5f43744b6d5e18d3b7c199f417d8

          SHA1

          b6534017fe59a38817a99c1a92a38b7404dba295

          SHA256

          73f4490289ccbc16837c7c8e59537278fcf6c9123c41f5e4b6dfe964d3066381

          SHA512

          a91602b6db15cb357dd08a34a87a25c005c87f811dd586736b20bcf5ddda98a457e2e615b8c9c5af6aba0b6af65621d794899f0c310d0f6ac287349f1dcf1e13

        • memory/2732-6-0x0000000002900000-0x0000000002980000-memory.dmp

          Filesize

          512KB

        • memory/2732-7-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

          Filesize

          2.9MB

        • memory/2732-8-0x0000000001E80000-0x0000000001E88000-memory.dmp

          Filesize

          32KB

        • memory/2808-14-0x000000001B720000-0x000000001BA02000-memory.dmp

          Filesize

          2.9MB

        • memory/2808-15-0x0000000002810000-0x0000000002818000-memory.dmp

          Filesize

          32KB

        • memory/3048-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

          Filesize

          4KB

        • memory/3048-1-0x0000000000D20000-0x0000000000D38000-memory.dmp

          Filesize

          96KB

        • memory/3048-30-0x0000000002160000-0x00000000021E0000-memory.dmp

          Filesize

          512KB

        • memory/3048-31-0x0000000002160000-0x00000000021E0000-memory.dmp

          Filesize

          512KB