Analysis
- max time kernel
140s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20250129-en - resource tags
- submitted
07/02/2025, 11:30
General
- Target SecuriteInfo.com.Trojan.Siggen21.26995.20995.13619.exe
- Size 1005KB
- Sample250207-nl9feaypc1
- SHA256 6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4
Malware Config
Extracted
-
xworm
-
127.0.0.1:2727
-
dnsdeerrorlehaxor.ddns.net:2727
-
Install_directory
%Public%
-
install_file
Discord.exe
-
telegram
https://api.telegram.org/bot5964175002:AAFK1mpStrMUWwegniLJuryZjOhVavZhSGo/sendMessage?chat_id=1745421249
Extracted
-
phemedrone
-
https://api.telegram.org/bot7602843389:AAE9dcCKuyUGx9HUNQf9KbsZDhME6HwC10g/sendMessage?chat_id=1745421249
Signatures
- Detect Xworm Payload 2 IoCs
- Phemedrone
An information and wallet stealer written in C#.
- Phemedrone family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen21.26995.20995.13619.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen21.26995.20995.13619.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Discord.exe"C:\Users\Public\Discord.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Public\Steam.exe"C:\Users\Public\Steam.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Discord.exe
Steam.exe
memory/868-25-0x0000020664850000-0x00000206648B6000-memory.dmp
memory/868-28-0x00007FFB40340000-0x00007FFB40E01000-memory.dmp
memory/868-29-0x00007FFB40340000-0x00007FFB40E01000-memory.dmp
memory/1804-21-0x0000000000AB0000-0x0000000000B0C000-memory.dmp
memory/1804-27-0x00007FFB40340000-0x00007FFB40E01000-memory.dmp
memory/1804-30-0x00007FFB40340000-0x00007FFB40E01000-memory.dmp
memory/1804-31-0x00007FFB40340000-0x00007FFB40E01000-memory.dmp
memory/4272-0-0x00007FFB40343000-0x00007FFB40345000-memory.dmp
memory/4272-1-0x0000000000BF0000-0x0000000000CF2000-memory.dmp