Analysis
-
max time kernel
570s -
max time network
567s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-01-2025 17:22
Behavioral task
behavioral1
Sample
sigmacit.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
-
Target
sigmacit.exe
-
Size
84KB
-
MD5
fd1a1484cb672a56397919536a9a6245
-
SHA1
be050296237d796240bc177003e9bb439fbab362
-
SHA256
893066e51bb3d4724a4afd40c8a78de9dff745c71390206ab3f8115c70138d4d
-
SHA512
26095e0e8d59ebb18d4cbeaaa5f6e08a1c90527849062409cac01e29b9e6db97aa6aae11348d066c950b848ec9248ea1df73dda704d590d6dc3c629329a9c262
-
SSDEEP
1536:dZV6b74SjZgbZKHOKSKl3xttjoRpb5D1kGGAKmO6iQovetHN7/uMZyIO9mbW:dvijluRKl3xttjoRpbx1kGGA1piL8Nz6
Score
10/10
Malware Config
Extracted
Family
xworm
Attributes
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/Lq5dsDAQ
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2380-1-0x0000000000930000-0x000000000094C000-memory.dmp family_xworm -
Xworm family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
flow ioc 135 pastebin.com 125 pastebin.com 158 pastebin.com 164 pastebin.com 170 pastebin.com 102 pastebin.com 111 pastebin.com 122 pastebin.com 80 pastebin.com 87 pastebin.com 101 pastebin.com 148 pastebin.com 171 pastebin.com 7 pastebin.com 45 pastebin.com 55 pastebin.com 175 pastebin.com 181 pastebin.com 128 pastebin.com 141 pastebin.com 36 pastebin.com 67 pastebin.com 107 pastebin.com 54 pastebin.com 92 pastebin.com 138 pastebin.com 176 pastebin.com 16 pastebin.com 32 pastebin.com 47 pastebin.com 76 pastebin.com 88 pastebin.com 127 pastebin.com 98 pastebin.com 121 pastebin.com 145 pastebin.com 157 pastebin.com 35 pastebin.com 63 pastebin.com 83 pastebin.com 104 pastebin.com 110 pastebin.com 179 pastebin.com 29 pastebin.com 44 pastebin.com 71 pastebin.com 99 pastebin.com 167 pastebin.com 6 pastebin.com 17 pastebin.com 41 pastebin.com 72 pastebin.com 151 pastebin.com 11 pastebin.com 150 pastebin.com 162 pastebin.com 85 pastebin.com 86 pastebin.com 100 pastebin.com 117 pastebin.com 132 pastebin.com 20 pastebin.com 39 pastebin.com 79 pastebin.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2380 sigmacit.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe 2852 Magnify.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2852 Magnify.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2852 2696 utilman.exe 34 PID 2696 wrote to memory of 2852 2696 utilman.exe 34 PID 2696 wrote to memory of 2852 2696 utilman.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\sigmacit.exe"C:\Users\Admin\AppData\Local\Temp\sigmacit.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
C:\Windows\system32\magnify.exe"C:\Windows\system32\magnify.exe"1⤵PID:2816
-
C:\Windows\system32\utilman.exeutilman.exe /debug1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\System32\Magnify.exe"C:\Windows\System32\Magnify.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2852
-