Analysis
-
max time kernel
122s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-01-2025 21:53
Static task
static1
Behavioral task
behavioral1
Sample
Serc.Pro Loader.exe
Resource
win7-20240903-en
General
-
Target
Serc.Pro Loader.exe
-
Size
76KB
-
MD5
1a56b39b62cff3bf7a75a708f6a11762
-
SHA1
180d91a57ebb95a81bfaa394bca35c123efa916e
-
SHA256
ad34f6a17ee318591b59ac4fbc300c53808630e4f163b644a58eadc85057348a
-
SHA512
b86dfa4287e283fd7e734cc3897589c2bb6b98e35f1c82a6ab50f271baf8a9748a125a6c04425ccdf93566ddacb453290a9a63e5fc0d2797b70fb70b6dac03fb
-
SSDEEP
1536:JqDtM7DwroXh9bSQ6/jyrV9nmRWnXzWb6Alyj:EwblSlryrV9nmwPeyj
Malware Config
Extracted
xworm
194.59.31.87:1111
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000012117-5.dat family_xworm behavioral1/memory/2680-8-0x0000000001310000-0x0000000001326000-memory.dmp family_xworm -
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2608 powershell.exe 1896 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2680 System32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2680 System32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2608 powershell.exe 1896 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2680 System32.exe Token: SeDebugPrivilege 2608 powershell.exe Token: SeDebugPrivilege 1896 powershell.exe Token: SeDebugPrivilege 2680 System32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2680 2728 Serc.Pro Loader.exe 31 PID 2728 wrote to memory of 2680 2728 Serc.Pro Loader.exe 31 PID 2728 wrote to memory of 2680 2728 Serc.Pro Loader.exe 31 PID 2728 wrote to memory of 2824 2728 Serc.Pro Loader.exe 32 PID 2728 wrote to memory of 2824 2728 Serc.Pro Loader.exe 32 PID 2728 wrote to memory of 2824 2728 Serc.Pro Loader.exe 32 PID 2680 wrote to memory of 2608 2680 System32.exe 34 PID 2680 wrote to memory of 2608 2680 System32.exe 34 PID 2680 wrote to memory of 2608 2680 System32.exe 34 PID 2680 wrote to memory of 1896 2680 System32.exe 36 PID 2680 wrote to memory of 1896 2680 System32.exe 36 PID 2680 wrote to memory of 1896 2680 System32.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\Serc.Pro Loader.exe"C:\Users\Admin\AppData\Local\Temp\Serc.Pro Loader.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Roaming\System32.exe"C:\Users\Admin\AppData\Roaming\System32.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System32.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System32.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Thanks For Using.txt2⤵PID:2824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5bbef7a446e939b5290049a75cca73e28
SHA1d601c708026f3f1f60cc5657b5756b61b7f69d44
SHA256ebc417aa82e5d9b3685e0ac7fb5f561a791863683c6cbae005f9d03659e388ca
SHA5121588f4149539f72fa85f5d64a7142491710cb9b6701d8b078696a09d30b47f2f872c54bd375c137a44f203842bed9fa140d3ef7e5952e4071ad8b90481ec73f7
-
Filesize
63KB
MD566bbe5829a613fedad7f79e2c6273448
SHA157314396a65e08b7bfc5f0b8cdfa9a050579d9d9
SHA25672499a032c26ef7031b942590e4dd2e28d60b332620c7d2dc42bc4b70995e0dd
SHA5129b0ea0bb6a4a6ae75c6463f2bc3b5bd012a40a89f491868979230b850b948240b40326c703211edd349911e97a218bf77d01d06f254c33d83939c21a152efae3
-
Filesize
57B
MD5f9cfd0c4da0a9a068f8a26ee31c85036
SHA1ea75b71cfdf7364eacfafcaac0421f9c80a2b4e5
SHA256e52f33ee65ceb7e5fe9cd47744888c089c37ba7dbadeaf345e75b5cadd43ee2d
SHA512f81823ed92d8f5aa299d0164f59fb77a3af4c6a9ca5a98e0d4b33104ec7f15ef19037d4bb4f3b2c8c1ca156bac2253f5052eb801468db73d71a67b10405e4b51