Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/03/2025, 22:47
Behavioral task
behavioral1
Sample
ASASQSQ.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ASASQSQ.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
XClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
XClient.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
es^p Supreme V1.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
es^p Supreme V1.exe
Resource
win10v2004-20250217-en
General
-
Target
ASASQSQ.exe
-
Size
1.7MB
-
MD5
1f583cdad39718a3bbb8b25b44ec2ce1
-
SHA1
fcf80c45499f3f42506e3bbc1cadd4103380b8db
-
SHA256
0d2e82ca0d95d0ccca529f976f6334bd623a0dbad25be79a3127521e5816fe94
-
SHA512
91dbcc3dbb43e64d02392a67c1d9fa80b7aafd1c4759b78fb6dbd3f55940c7dc05c00d0091b070c17400ce3a78c3fd3f3ef579604d0c2d5bed39d476bb7f9f57
-
SSDEEP
49152:qjQ3JroNE7cZchtwBqN9smtUI1293vaRSO3:qcwE7ichtMY9suUIyQf
Malware Config
Extracted
xworm
147.185.221.26:38655
-
Install_directory
%AppData%
-
install_file
♬ ♬.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000016276-11.dat family_xworm behavioral1/memory/2372-14-0x0000000000A00000-0x0000000000A3A000-memory.dmp family_xworm -
Xworm family
-
Executes dropped EXE 2 IoCs
pid Process 2200 es^p Supreme V1.exe 2372 XClient.exe -
Loads dropped DLL 2 IoCs
pid Process 2988 ASASQSQ.exe 2988 ASASQSQ.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASASQSQ.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2372 XClient.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2200 2988 ASASQSQ.exe 31 PID 2988 wrote to memory of 2200 2988 ASASQSQ.exe 31 PID 2988 wrote to memory of 2200 2988 ASASQSQ.exe 31 PID 2988 wrote to memory of 2200 2988 ASASQSQ.exe 31 PID 2988 wrote to memory of 2372 2988 ASASQSQ.exe 32 PID 2988 wrote to memory of 2372 2988 ASASQSQ.exe 32 PID 2988 wrote to memory of 2372 2988 ASASQSQ.exe 32 PID 2988 wrote to memory of 2372 2988 ASASQSQ.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\ASASQSQ.exe"C:\Users\Admin\AppData\Local\Temp\ASASQSQ.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\es^p Supreme V1.exe"C:\Users\Admin\AppData\Local\Temp\es^p Supreme V1.exe"2⤵
- Executes dropped EXE
PID:2200
-
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210KB
MD56f44d5dd4b1fb7c1d2aaefa76c078a22
SHA1d4f08c5390c240e9b049d17d9e194143cff780df
SHA256cf964077390a9d3ae946829975483f8aae1da1cd2a0385cc66107e4b84e56a18
SHA51212ef5efa88531b62961d2f13ab32a9b1fb6ba39eca6d2916d217a73765adfe62f4438d2e4b70032aee1f0b376082a633b2cab8082170007d2a8d51a8f0e45824
-
Filesize
2.4MB
MD513bab5a9b8cf9299313bd11fb57b0d2a
SHA19c2b902d6aa01085b0a2a8def75a47852fa316cd
SHA256f517cf20ddc450820ebddf607250dcfb6c9643c5a58b017118acadf7da181d2e
SHA512c1e6afbf3d187ea50735440a9525156cf225c0ffe62e5182568b7fffa1fd3c297074cdcc036f2babb53121f08439e8aeaa148910c3ca891aeb52764be6f19ca4