Analysis
-
max time kernel
1020s -
max time network
428s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2025, 17:09
General
-
Target
Bet.exe
-
Size
77KB
-
MD5
0cc82efcede7f5764067f896b7a5049b
-
SHA1
3d0a7c61b27d6ffb96973dc81385d903ffe50905
-
SHA256
b0d124709d9eb4cf5097343e50eb1ca9785ce7fac3d4403907a3c626cbdd34b5
-
SHA512
032fd3c747c6447216fe80978573238a04622d801bc7ca66b81f48ef51e1fd554e14935da7d446ff68f981e39227002a8d091f87e96edd3301844207b066f88c
-
SSDEEP
1536:WqrR3YsyK3dnQfHYmsGHmHiLQHbghg5adYD6elEP2XRKOIxpEg:Wq1YsygpKHYqHmaQHbgaYdCufOI7Eg
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%AppData%
-
install_file
Sihost.exe
-
pastebin_url
https://pastebin.com/raw/hA5YVNf1
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2756-1-0x00000000001C0000-0x00000000001DA000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4908 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2756 Bet.exe Token: SeDebugPrivilege 4908 taskmgr.exe Token: SeSystemProfilePrivilege 4908 taskmgr.exe Token: SeCreateGlobalPrivilege 4908 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe 4908 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bet.exe"C:\Users\Admin\AppData\Local\Temp\Bet.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4908