Overview

overview

10

Static

static

10

Builder Wo...��.exe

windows7-x64

10

Builder Wo...��.exe

windows10-2004-x64

10

DefenderRemover.exe

windows7-x64

3

DefenderRemover.exe

windows10-2004-x64

3

DefenderRemover.exe

windows7-x64

3

DefenderRemover.exe

windows10-2004-x64

3

DotNetZip.dll

windows7-x64

1

DotNetZip.dll

windows10-2004-x64

1

Extreme.Net.dll

windows7-x64

1

Extreme.Net.dll

windows10-2004-x64

1

MetroFrame...gn.dll

windows7-x64

1

MetroFrame...gn.dll

windows10-2004-x64

1

MetroFrame...ts.dll

windows7-x64

1

MetroFrame...ts.dll

windows10-2004-x64

1

MetroFramework.dll

windows7-x64

1

MetroFramework.dll

windows10-2004-x64

1

Mono.Cecil.dll

windows7-x64

1

Mono.Cecil.dll

windows10-2004-x64

1

stub.exe

windows7-x64

10

stub.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BuilderWorldWindPro1.zip

  • Size

    2.4MB

  • Sample

    250102-w4c4xstpaj

  • MD5

    82a0e194de7cb967c13494efa4e3f3a6

  • SHA1

    c1b8a0428538841272e57972eda61879768cfcbc

  • SHA256

    ebba736dfa26b559658df13cda55e2aef8cf744c05f817396ef1d3b17870a83e

  • SHA512

    60a85f906a0b9ef468b27b396683a5e5a5a762ae3f16e2a23e45b09657a984142ee68a1e92162c1ec3ab7c82c074ef8f642a5fea4bd8d53c551533b87b09b383

  • SSDEEP

    49152:nHqaHgIuK4sLgsAhmHa7HAIkc0UOX9Hp63nfUxR:nHqaHb6Jhn3kc0UOXSnfUR

Score
10/10
asyncratstormkittyxwormdefaultdiscoveryexecutionratstealertrojan

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

xworm

C2

dsasinject-58214.portmap.io:3389

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot7023899363:AAFEzgbfWzhyE32Lf95TKSRYEYXMd4AfMyk/sendMessage?chat_id=6354844663

Targets

    • Target

      Builder WorldWind Pro‌‌.exe

    • Size

      386KB

    • MD5

      142b02b4b22c03523db3522ce6fd6b10

    • SHA1

      836cd20f44621aeca77d7ec4253d1aa92695a40a

    • SHA256

      aac53980d79ea8fd1358d7b6b29a0693e71bf8ad936b91d06e953e6855aab1e6

    • SHA512

      849dae7774ebd950482c6a2c10000411932221ddbe4f72f266a3fd9c457894ca185214841e9de91680eb5781831ff7fcb018e9810ff81b3f616f0c45fc5eee23

    • SSDEEP

      6144:1HuW1RSlFXGcf2PqLtrLG3LN8MoJJEvHaY+42R6pLTcDaWfCG1kDuf:1OWzSlFD+ItrkhoD2aKpLlWfCGqi

    Score
    10/10
    xwormdiscoveryexecutionrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    behavioral1behavioral2

    • Target

      DefenderRemover.exe

    • Size

      664KB

    • MD5

      7a3e43c2971746c84d32f8a448823673

    • SHA1

      08b75724c68f25ac831ba2c7508f18bf3a398c9f

    • SHA256

      c7bdcebe60356900dc4b4f8bc8b75acc1536df33ae7a1049bfa27192b8c62d0a

    • SHA512

      702ea07e5377387cf938554c8fab55847cc72e06997f318099940db2b0af7d06acf326be3699569b65a9a265e617cab13c2930614bc3a0cb2e02ee82fd79c8f5

    • SSDEEP

      12288:u1OgLda0ZjpVxCSDrqzU7rOv/O6/NH90u9KIyburq6fAdAYmyw:u1OYdaypVxCiIO6/LXEYr8dAByw

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      DefenderRemover.exe

    • Size

      664KB

    • MD5

      7a3e43c2971746c84d32f8a448823673

    • SHA1

      08b75724c68f25ac831ba2c7508f18bf3a398c9f

    • SHA256

      c7bdcebe60356900dc4b4f8bc8b75acc1536df33ae7a1049bfa27192b8c62d0a

    • SHA512

      702ea07e5377387cf938554c8fab55847cc72e06997f318099940db2b0af7d06acf326be3699569b65a9a265e617cab13c2930614bc3a0cb2e02ee82fd79c8f5

    • SSDEEP

      12288:u1OgLda0ZjpVxCSDrqzU7rOv/O6/NH90u9KIyburq6fAdAYmyw:u1OYdaypVxCiIO6/LXEYr8dAByw

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      DotNetZip.dll

    • Size

      448KB

    • MD5

      6d1c62ec1c2ef722f49b2d8dd4a4df16

    • SHA1

      1bb08a979b7987bc7736a8cfa4779383cb0ecfa6

    • SHA256

      00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c

    • SHA512

      c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2

    • SSDEEP

      6144:FuCIjOL8qwWN/jMlC/XiapWSu9vnITVxGtSV41kJDsTDD5rlGe6wfxLV/7:dZLJLdvOSsnjS4csBrge6sf7

    Score
    1/10
    behavioral7behavioral8

    • Target

      Extreme.Net.dll

    • Size

      121KB

    • MD5

      f79f0e3a0361cac000e2d3553753cd68

    • SHA1

      4314bcef76fddc9379a8f3a266b37d685d0adb79

    • SHA256

      8a6518ab7419fbec3ac9875baa3afb410ad1398c7aa622a09cd9084ec6cadfcd

    • SHA512

      c77516e7f5540ecd13fa5d8cecfce34629acecd9b5a445f5f48902c9e823328fa9a6694ecaa39f5b6053de61c2b850c2d87df25357548afaad6ec37eb3e5e355

    • SSDEEP

      3072:bdoECIgjBibgp2tBqL0Y++ruXqMG4ih3lbpMqc:bdoECIgUrG

    Score
    1/10
    behavioral10behavioral9

    • Target

      MetroFramework.Design.dll

    • Size

      16KB

    • MD5

      c853e9e8c720249198ff376f42328ef9

    • SHA1

      a56ee195148023571e26ffeaa5a736bc73a76c40

    • SHA256

      28089707733c92c7fade97e7b6fab4007e7b8bfd6dc7a8526a3ea597f1a30845

    • SHA512

      d21cf5cfe0a5e2f7d4c128e64e0decee28028297c804319fb957b1f0e60d62e3103976b95abc3d2bd5ba66801cb5fe9bef4bae067273079177be28c73132c739

    • SSDEEP

      384:k1q4fJwcRJTxK0JLBamLGqPkO9V1VFf5L7W1OYKjbq9w:6q4hwcRBJLBamSqPkO9V1ViGq9

    Score
    1/10
    behavioral11behavioral12

    • Target

      MetroFramework.Fonts.dll

    • Size

      656KB

    • MD5

      b8c8a532438c4b421081efb258355469

    • SHA1

      41aa88d5eaf398da55f712f30226b70492125be1

    • SHA256

      15a605129cac3663ba1ddb98f5798334fba5e7954ee36a69727299b4e366c2eb

    • SHA512

      511070c8cfe018e60e11d495393152e10aa2aa0c08cde84678ef3a0efd63ae5c562a47bfab883f4babd469b1873127bacc9c986cb2bc096985176f1dbf93b1fc

    • SSDEEP

      12288:5+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:5+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw

    Score
    1/10
    behavioral13behavioral14

    • Target

      MetroFramework.dll

    • Size

      313KB

    • MD5

      b20f1b5e3d4e3df2d826e9870637cd06

    • SHA1

      a03bb47afdf9498be409ed5b56e945f6e143fb32

    • SHA256

      9e58f13deb328455f216f165588b5f5111ecd12042d7dd196686dfb0f0fc68eb

    • SHA512

      095c5956ebc114c4b380d2b43981bcabd221782530328a51cb2c6aec05a016dad2e5efae36810f6840611f77f589be1e1e7f2200738df3bca222381837033b2d

    • SSDEEP

      6144:Ys+J/PxfbpAQ1bZHE7Zhm6uOw0g749O2:qJ/PxzpAObhV6uO99O

    Score
    1/10
    behavioral15behavioral16

    • Target

      Mono.Cecil.dll

    • Size

      273KB

    • MD5

      80ea4bfe7944e2f384d97488c83d9d25

    • SHA1

      18789622bdff9d99683504faf2a302a194e3b6c0

    • SHA256

      1a1565804348c2e621e0a509cedaa516eeb7e9fadfbeefe58e1e9cf8ec16b915

    • SHA512

      561e8c8465c1989dcc6c03b221f24c0f5c0ee278ff244d171f1761c79ee83debcb00973e2027be28ae77e47956a192b2a4a019e83b2802c62639f5d375aabe5b

    • SSDEEP

      6144:P0eCY7BUB5SH41/sE0oWZSSCvXb9PKdJDkPWeUP:syK7t1EKWZS1vXbw

    Score
    1/10
    behavioral17behavioral18

    • Target

      stub.dll

    • Size

      169KB

    • MD5

      fa88f24eab7de6a32660b75bb72352cb

    • SHA1

      21b557154d87ddc57949d51838b1c18e5582a068

    • SHA256

      ec3aa251b8fc99c510f9f6f7d59bfe57f1b79d925d3e5faa0e2e08610597fe09

    • SHA512

      f01ec8bb73467e01715fd877b4b168974f078e03e69c7b3c379eb8f9798531ffa9a496b2c8e348de2f31dbf01acb4a122a681b98f443c6d9d2ac27faa68acba7

    • SSDEEP

      3072:UySRwk/N2wtuh77yHcokLZl4JLrBt6qIPu/i9bVK2cvwAuY+Wpu:FkV9tuh77ypkLTaPr6XPSi9b43

    Score
    10/10
    asyncratstormkittydefaultdiscoveryratstealer

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty
    behavioral19behavioral20

MITRE ATT&CK Enterprise v15

Tasks