Overview

overview

10

Static

static

10

Stupid Monkey.exe

windows7-x64

10

Stupid Monkey.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2025 09:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Stupid Monkey.exe

  • Size

    70KB

  • MD5

    4c785ba0487bfec51faf4788d564ee9f

  • SHA1

    786fdc994a71d7e02a556e3f720b41a096a789f5

  • SHA256

    c81ae973db641e3c60912166be8979a60b95253ae290c145b9a2133ad7a2ebb8

  • SHA512

    b6b7fbd58e1c3657a81d17a974fc609c1af29dab6489685d2eea5e1397e12853c17086a537f7607aef6833f358965788adc961b44eeff21530ff89f9776eee06

  • SSDEEP

    1536:X7eLuJn1XH70d76kbDD0k2jF16K7HmTzOt5YP:X79hpb0YkbDLE57HmTzOts

Score
10/10
discordratxwormdefense_evasionexecutionpersistenceratrootkitstealertrojan

Malware Config

Extracted

Family

xworm

C2

wood-matches.gl.at.ply.gg:23086

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMzMDMyNzc3MjM3NTAyNzgxMg.GWNm0N.hjhDXtec3jd5n3sEjWHGfGyOO28kBaPWiS-HPA

  • server_id

    1330267614202560512

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 1 IoCs
  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Discordrat family
    discordrat
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables Task Manager via registry modification
    defense_evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Stupid Monkey.exe
    "C:\Users\Admin\AppData\Local\Temp\Stupid Monkey.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Stupid Monkey.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Stupid Monkey.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2256
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Client Server Runtime Process'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1308
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Client Server Runtime Process'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2220
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Client Server Runtime Process" /tr "C:\ProgramData\Client Server Runtime Process"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1232
    • C:\Users\Admin\AppData\Local\Temp\egkjbn.exe
      "C:\Users\Admin\AppData\Local\Temp\egkjbn.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2476 -s 596
        3⤵
        • Loads dropped DLL
        PID:1372
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {54A502F7-8838-4220-9771-4115A43C572E} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
    1⤵
      PID:1072

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
      Filesize

      7KB

      MD5

      cbd22fc759e05bf0f86b6b37f4b87281

      SHA1

      821cb3b9a0d072206b02ed7af8bf5514e6a868d1

      SHA256

      71057b26503c700f6d725934a9b95b33f444423d36099050258c0f0782f1b5a1

      SHA512

      310422fe82a03aa371be02f17f711496169a388133c85b48a96970b20b1c6b87bfb568b02bd7699c82ff95cd56db68eeb3270dc8ec66399f78f068c32b1661bf

      Download Submit

    • \Users\Admin\AppData\Local\Temp\egkjbn.exe
      Filesize

      78KB

      MD5

      24b361200a5fc61a62657c8ef7886d1f

      SHA1

      a6e4602b47f50e943603c5164bd6750e3b58a5ef

      SHA256

      7f4b62dd5a02a17056e390f59bca7a314d40bc3e8928307a56b558033dd58bb7

      SHA512

      a1081da6c801dbe649b25c7bc7fce26a20d22b574df0b9b0050ec8089acc29f86f28f77bdbd3610210452255162939832c7a7e35344a9335981e0fef4cd4542a

      Download Submit

    • memory/2256-16-0x0000000002690000-0x0000000002698000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2256-15-0x000000001B520000-0x000000001B802000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/2476-38-0x000000013F570000-0x000000013F588000-memory.dmp

      Filesize

      96KB

      Download

    • memory/2628-9-0x0000000001E70000-0x0000000001E78000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2628-8-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/2628-7-0x0000000002BC0000-0x0000000002C40000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2720-2-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2720-27-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2720-31-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2720-1-0x0000000000160000-0x0000000000178000-memory.dmp

      Filesize

      96KB

      Download

    • memory/2720-0-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2720-44-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2720-45-0x000000001AD00000-0x000000001AD0C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2720-190-0x000000001ABF0000-0x000000001ABFE000-memory.dmp

      Filesize

      56KB

      Download