Analysis
-
max time kernel
566s -
max time network
547s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2025 01:02
General
-
Target
adsa.exe
-
Size
61KB
-
MD5
6afe04684a757675a359e7152592e644
-
SHA1
d436a89ed573a6f5cb5d9b5f5d971cc12ac09e7b
-
SHA256
734583184759ee71d9a25e037f25e409f2f1c7adfd1927bf6838bbfb62f2195e
-
SHA512
25d29d6ceb7d2aaf57d689dba5bad64268151cad17d989b34dadb5146a10f6e15e9a424c927a453d2cdc0e78e0561c348d78e98c1250fc590420ad21b3bed94a
-
SSDEEP
1536:wmtWxjhNJeaJXi+btWeYpive5scO3yKWRC6:wPjhNwaJXi+bw3EqhO3yKWU6
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:18889
147.185.221.25:18889
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2160-1-0x0000000000560000-0x0000000000576000-memory.dmp family_xworm -
Xworm family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 2160 adsa.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2160 adsa.exe Token: SeDebugPrivilege 5080 taskmgr.exe Token: SeSystemProfilePrivilege 5080 taskmgr.exe Token: SeCreateGlobalPrivilege 5080 taskmgr.exe Token: 33 5080 taskmgr.exe Token: SeIncBasePriorityPrivilege 5080 taskmgr.exe -
Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe -
Suspicious use of SendNotifyMessage 63 IoCs
pid Process 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe 5080 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2160 adsa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adsa.exe"C:\Users\Admin\AppData\Local\Temp\adsa.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2160
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5080