Analysis
-
max time kernel
129s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 17:38
Behavioral task
behavioral1
Sample
FatalityCrack.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FatalityCrack.exe
Resource
win10v2004-20241007-en
General
-
Target
FatalityCrack.exe
-
Size
74KB
-
MD5
44217b6e8f45f82ebffe92321639290b
-
SHA1
6bd7da4585d438bc28d5350b9415b6d73b32e807
-
SHA256
657dcc3378b3dbbd131926612fb00e67683ccbc64dc2d743fce213734804f427
-
SHA512
a68f7f194aadd63dcfad5af49dac4def19748e8fb657ab4cc06b514a1a7a2f5fb42424cb1a54a259987487558f2f2c950a1fd219a59f9b27ef826774ae27e7c8
-
SSDEEP
1536:FNhc3BhmLTzjuReXV2y+bo0QnRr6wDeTJPovOoRnaRxsZP:1cxEWRsV2y+boveoOoRN5
Malware Config
Extracted
xworm
userxmorma-27072.portmap.host:27072
-
Install_directory
%ProgramData%
-
install_file
svchost.exe
-
telegram
https://api.telegram.org/bot8050356849:AAGkujkVbiAoFzC-JTeiZPs5sCb3sdrY2sU/sendMessage?chat_id=8050356849
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/3048-1-0x0000000000D20000-0x0000000000D38000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2732 powershell.exe 2808 powershell.exe 2604 powershell.exe 1308 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk FatalityCrack.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk FatalityCrack.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost.exe" FatalityCrack.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2732 powershell.exe 2808 powershell.exe 2604 powershell.exe 1308 powershell.exe 3048 FatalityCrack.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3048 FatalityCrack.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 2808 powershell.exe Token: SeDebugPrivilege 2604 powershell.exe Token: SeDebugPrivilege 1308 powershell.exe Token: SeDebugPrivilege 3048 FatalityCrack.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3048 FatalityCrack.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2732 3048 FatalityCrack.exe 30 PID 3048 wrote to memory of 2732 3048 FatalityCrack.exe 30 PID 3048 wrote to memory of 2732 3048 FatalityCrack.exe 30 PID 3048 wrote to memory of 2808 3048 FatalityCrack.exe 32 PID 3048 wrote to memory of 2808 3048 FatalityCrack.exe 32 PID 3048 wrote to memory of 2808 3048 FatalityCrack.exe 32 PID 3048 wrote to memory of 2604 3048 FatalityCrack.exe 34 PID 3048 wrote to memory of 2604 3048 FatalityCrack.exe 34 PID 3048 wrote to memory of 2604 3048 FatalityCrack.exe 34 PID 3048 wrote to memory of 1308 3048 FatalityCrack.exe 36 PID 3048 wrote to memory of 1308 3048 FatalityCrack.exe 36 PID 3048 wrote to memory of 1308 3048 FatalityCrack.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\FatalityCrack.exe"C:\Users\Admin\AppData\Local\Temp\FatalityCrack.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\FatalityCrack.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'FatalityCrack.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD52b1f5f43744b6d5e18d3b7c199f417d8
SHA1b6534017fe59a38817a99c1a92a38b7404dba295
SHA25673f4490289ccbc16837c7c8e59537278fcf6c9123c41f5e4b6dfe964d3066381
SHA512a91602b6db15cb357dd08a34a87a25c005c87f811dd586736b20bcf5ddda98a457e2e615b8c9c5af6aba0b6af65621d794899f0c310d0f6ac287349f1dcf1e13