Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2025 01:03

General

  • Target

    это вирус точно 100%.exe

  • Size

    40KB

  • MD5

    1b5eb77c95028f1f0a037cdf922e59d7

  • SHA1

    50acd4ca6a89d06ff90e2535ce61b9ed590839e6

  • SHA256

    149acfe76687a7b65baca4ffefc576ca1baa7eb54113212622831049da88d994

  • SHA512

    801a611fcbcdedec916e731e39a3ba84e12810ef9ac1ecd4737cd561a7ba3e3b37f5ffd4783520494dae5beb55c6066468882a69e3ca56382e72e84e2aec4c22

  • SSDEEP

    768:qa7krH8jlOMW88A4NVlwXDUDX+WcvQzFPc9YHLOphbQ4Z:f7krHGlOVYe5SEFk9YHLOp24Z

Malware Config

Extracted

Family

xworm

Version

5.0

C2

g-submit.gl.at.ply.gg:54103

22.ip.gl.ply.gg:54103

Mutex

43Ou45H2oyqWjrvD

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    svchost.exe

aes.plain

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\это вирус точно 100%.exe
    "C:\Users\Admin\AppData\Local\Temp\это вирус точно 100%.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2388
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {1FD0A1DA-B722-4180-B156-28E5AC80BBB9} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\ProgramData\svchost.exe
      C:\ProgramData\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2840
    • C:\ProgramData\svchost.exe
      C:\ProgramData\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\svchost.exe

    Filesize

    40KB

    MD5

    1b5eb77c95028f1f0a037cdf922e59d7

    SHA1

    50acd4ca6a89d06ff90e2535ce61b9ed590839e6

    SHA256

    149acfe76687a7b65baca4ffefc576ca1baa7eb54113212622831049da88d994

    SHA512

    801a611fcbcdedec916e731e39a3ba84e12810ef9ac1ecd4737cd561a7ba3e3b37f5ffd4783520494dae5beb55c6066468882a69e3ca56382e72e84e2aec4c22

  • memory/2556-0-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

    Filesize

    4KB

  • memory/2556-1-0x0000000000EB0000-0x0000000000EC0000-memory.dmp

    Filesize

    64KB

  • memory/2556-6-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

    Filesize

    9.9MB

  • memory/2556-7-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

    Filesize

    4KB

  • memory/2556-8-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

    Filesize

    9.9MB

  • memory/2840-12-0x0000000001120000-0x0000000001130000-memory.dmp

    Filesize

    64KB