Analysis
-
max time kernel
809s -
max time network
808s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-01-2025 17:22
Behavioral task
behavioral1
Sample
sigmacit.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
-
Target
sigmacit.exe
-
Size
84KB
-
MD5
fd1a1484cb672a56397919536a9a6245
-
SHA1
be050296237d796240bc177003e9bb439fbab362
-
SHA256
893066e51bb3d4724a4afd40c8a78de9dff745c71390206ab3f8115c70138d4d
-
SHA512
26095e0e8d59ebb18d4cbeaaa5f6e08a1c90527849062409cac01e29b9e6db97aa6aae11348d066c950b848ec9248ea1df73dda704d590d6dc3c629329a9c262
-
SSDEEP
1536:dZV6b74SjZgbZKHOKSKl3xttjoRpb5D1kGGAKmO6iQovetHN7/uMZyIO9mbW:dvijluRKl3xttjoRpbx1kGGA1piL8Nz6
Malware Config
Extracted
Family
xworm
Attributes
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/Lq5dsDAQ
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/1456-1-0x00000000001D0000-0x00000000001EC000-memory.dmp family_xworm -
Xworm family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
flow ioc 138 pastebin.com 172 pastebin.com 265 pastebin.com 225 pastebin.com 17 pastebin.com 21 pastebin.com 139 pastebin.com 302 pastebin.com 24 pastebin.com 142 pastebin.com 164 pastebin.com 179 pastebin.com 181 pastebin.com 229 pastebin.com 285 pastebin.com 120 pastebin.com 185 pastebin.com 210 pastebin.com 213 pastebin.com 232 pastebin.com 241 pastebin.com 126 pastebin.com 189 pastebin.com 220 pastebin.com 227 pastebin.com 294 pastebin.com 56 pastebin.com 127 pastebin.com 162 pastebin.com 291 pastebin.com 308 pastebin.com 206 pastebin.com 262 pastebin.com 57 pastebin.com 87 pastebin.com 97 pastebin.com 104 pastebin.com 135 pastebin.com 147 pastebin.com 304 pastebin.com 315 pastebin.com 66 pastebin.com 132 pastebin.com 222 pastebin.com 242 pastebin.com 259 pastebin.com 313 pastebin.com 290 pastebin.com 78 pastebin.com 99 pastebin.com 115 pastebin.com 123 pastebin.com 133 pastebin.com 166 pastebin.com 205 pastebin.com 260 pastebin.com 273 pastebin.com 54 pastebin.com 68 pastebin.com 255 pastebin.com 271 pastebin.com 292 pastebin.com 86 pastebin.com 91 pastebin.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1156 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1456 sigmacit.exe Token: SeDebugPrivilege 1156 taskmgr.exe Token: SeSystemProfilePrivilege 1156 taskmgr.exe Token: SeCreateGlobalPrivilege 1156 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe 1156 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sigmacit.exe"C:\Users\Admin\AppData\Local\Temp\sigmacit.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1156