Analysis
-
max time kernel
88s -
max time network
89s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2025 17:10
Behavioral task
behavioral1
Sample
amongus hook.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
amongus hook.exe
-
Size
79KB
-
MD5
810d912112f579781879ada392b70a53
-
SHA1
247bc212d2d44184bae484049765240ac9fa5c32
-
SHA256
aee4ca6b2f3b07e85920f81b32acc5350d198439b181e997cd6a8e3ecbe9c939
-
SHA512
30fb6d77563a3a0d6b94a9ea9fc2f67c6dda3dc3ac2afd4e968ec998f2eabd1797d751fdac491a979e68301efc633c47fb2668a8abd0c5f0dcff6d12ed8ead0e
-
SSDEEP
1536:N/SpZjwaZD0YqEnwqaDrMk+bXxNEPZSBVGGmMRZOf4miljMt8xwR2:CEYqEwjrv+bB8DMRZOf4m8M+a2
Score
10/10
Malware Config
Extracted
Family
xworm
C2
daily-sexually.gl.at.ply.gg:25670
Attributes
-
Install_directory
%AppData%
-
install_file
Update.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/memory/5104-1-0x00000000001C0000-0x00000000001DA000-memory.dmp family_xworm behavioral1/files/0x000a000000023b81-22.dat family_xworm -
Xworm family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk amongus hook.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk amongus hook.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe" amongus hook.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5104 amongus hook.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3208 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 5104 amongus hook.exe Token: SeDebugPrivilege 5104 amongus hook.exe Token: SeDebugPrivilege 3208 taskmgr.exe Token: SeSystemProfilePrivilege 3208 taskmgr.exe Token: SeCreateGlobalPrivilege 3208 taskmgr.exe Token: SeSecurityPrivilege 3208 taskmgr.exe Token: SeTakeOwnershipPrivilege 3208 taskmgr.exe Token: SeBackupPrivilege 868 svchost.exe Token: SeRestorePrivilege 868 svchost.exe Token: SeSecurityPrivilege 868 svchost.exe Token: SeTakeOwnershipPrivilege 868 svchost.exe Token: 35 868 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe 3208 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5104 amongus hook.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\amongus hook.exe"C:\Users\Admin\AppData\Local\Temp\amongus hook.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5104
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3208
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:868
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
766B
MD505b3be8d5b75eb4261a32cf2c6abf656
SHA16301b9b9499b6ba49dad15ad6a5cfe57708b6a77
SHA256a5914cc4bf8f8cdb789135102db256779bdf792424179ae92b37e869c6578dfd
SHA512f850e18a65b4fc683a0db2586c1aef5098d004d3f73d440f6c99312f7118af87f0010d391dd79dd0a5de33570649f7706be9eb60882d1a8ce92c439bb504102b
-
Filesize
79KB
MD5810d912112f579781879ada392b70a53
SHA1247bc212d2d44184bae484049765240ac9fa5c32
SHA256aee4ca6b2f3b07e85920f81b32acc5350d198439b181e997cd6a8e3ecbe9c939
SHA51230fb6d77563a3a0d6b94a9ea9fc2f67c6dda3dc3ac2afd4e968ec998f2eabd1797d751fdac491a979e68301efc633c47fb2668a8abd0c5f0dcff6d12ed8ead0e