Overview

overview

10

Static

static

10

User Password.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-01-2025 18:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    User Password.exe

  • Size

    49KB

  • MD5

    9cda258445b322eb90f65b32ba86d86c

  • SHA1

    d86a39dcc80db9cef23fc389dbbb6951ed7f908c

  • SHA256

    0aca70f4574b4f593ad118de1846cb744eed48473a8fd51759c37e508d44e50f

  • SHA512

    f76c77b63b6e881cd6e9a436b5efe5e4a45a8e78126fcc6876ec6855ef2572ba7e9dec7200e32ddca78f232d451305f87729ee5989f3c8ed83cde53d132a1d9a

  • SSDEEP

    768:DaT5ryS4lEW64POSn1iQK4kb2UULNwLdVvM6wEO1hEjdoHj:GNrH+EWR5rkbzeNivM6wEO1yaj

Score
10/10
gurcustormkittyxwormdiscoveryexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

sponef159-35748.portmap.host:35748

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot7508868671:AAG6XIOhz39IrQIUnjub1TKVOVZHfdjpsvM/sendMessage?chat_id=6094400048

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7508868671:AAG6XIOhz39IrQIUnjub1TKVOVZHfdjpsvM/sendMessage?chat_id=6094400048

Signatures

  • Detect Xworm Payload 2 IoCs
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\User Password.exe
    "C:\Users\Admin\AppData\Local\Temp\User Password.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\User Password.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4272
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'User Password.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1920
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4008
    • C:\Windows\SYSTEM32\CMD.EXE
      "CMD.EXE"
      2⤵
        PID:1084
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3116
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3880
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2076

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Browser Information Discovery

    1
    T1217

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    3
    T1012

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
      Filesize

      654B

      MD5

      2ff39f6c7249774be85fd60a8f9a245e

      SHA1

      684ff36b31aedc1e587c8496c02722c6698c1c4e

      SHA256

      e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

      SHA512

      1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      3a6bad9528f8e23fb5c77fbd81fa28e8

      SHA1

      f127317c3bc6407f536c0f0600dcbcf1aabfba36

      SHA256

      986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

      SHA512

      846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      0aa63dbb46d451e47a7a682c64af776d

      SHA1

      3b0026f2dae8e9c491ccaa40133755779de35aaa

      SHA256

      9158038718d41172c22a3c1a15852405e3e1c8e2c44fa066328eb1520e5d977b

      SHA512

      4d2564850c2ab1bc71089412f19147df4a1cd3075aa2039aa894271b333cd9c510b7ba4d70889f24d45d8b366d8b5167abdcf24314e4753420337c7d34e7c43f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      96e3b86880fedd5afc001d108732a3e5

      SHA1

      8fc17b39d744a9590a6d5897012da5e6757439a3

      SHA256

      c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294

      SHA512

      909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tnzomfy5.1vr.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk
      Filesize

      771B

      MD5

      0684609f621604a981ae5fdd9382a904

      SHA1

      96c2f489c5c98f7ce70e09d92d177abd8f67c848

      SHA256

      5aa7205eaeaf0c246a3538560b6cdf230379ac00b1d3e999cb3d8e540bff1804

      SHA512

      5f219169c09e76bb70cbf39c8231244c15d01fa5b4bbd002e9f9a21bb6fc4bc9cd67eb5099752b8efcf038964fa0e7389db28d438a8dd22f31b56783501488b7

      Download Submit

    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      49KB

      MD5

      9cda258445b322eb90f65b32ba86d86c

      SHA1

      d86a39dcc80db9cef23fc389dbbb6951ed7f908c

      SHA256

      0aca70f4574b4f593ad118de1846cb744eed48473a8fd51759c37e508d44e50f

      SHA512

      f76c77b63b6e881cd6e9a436b5efe5e4a45a8e78126fcc6876ec6855ef2572ba7e9dec7200e32ddca78f232d451305f87729ee5989f3c8ed83cde53d132a1d9a

      Download Submit

    • memory/1356-75-0x000000001B670000-0x000000001B67A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1356-77-0x000000001D100000-0x000000001D220000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/1356-0-0x00007FF989863000-0x00007FF989865000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1356-1-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/1356-56-0x00007FF989860000-0x00007FF98A321000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1356-57-0x00007FF989860000-0x00007FF98A321000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3116-66-0x0000015B66550000-0x0000015B66551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3116-58-0x0000015B66550000-0x0000015B66551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3116-59-0x0000015B66550000-0x0000015B66551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3116-70-0x0000015B66550000-0x0000015B66551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3116-69-0x0000015B66550000-0x0000015B66551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3116-68-0x0000015B66550000-0x0000015B66551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3116-67-0x0000015B66550000-0x0000015B66551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3116-60-0x0000015B66550000-0x0000015B66551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3116-64-0x0000015B66550000-0x0000015B66551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3116-65-0x0000015B66550000-0x0000015B66551000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4272-17-0x00007FF989860000-0x00007FF98A321000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4272-14-0x00007FF989860000-0x00007FF98A321000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4272-12-0x00007FF989860000-0x00007FF98A321000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4272-13-0x00007FF989860000-0x00007FF98A321000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4272-7-0x0000021E709D0000-0x0000021E709F2000-memory.dmp

      Filesize

      136KB

      Download