Analysis
-
max time kernel
93s -
max time network
210s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
05/03/2025, 19:12
General
-
Target
максим лох.exe
-
Size
41KB
-
MD5
0011dad9c1a4c80a85c6ec8b6a3791ec
-
SHA1
6c9e04a11aadfad3d5209fef124d85d0a7649ff2
-
SHA256
9f096de5b225151543a66faa6ca95dc772c0167b7b75bf2dbec2c2ca64874491
-
SHA512
f60dcf603907e3291e21378c5f413a0623358b30be05e05e6f55c1d025585a7959513d1c811fa68844fc7f7575fc6eeb99d8d695b0c1f452cd77f349b1e92cd3
-
SSDEEP
768:NBFMiKhUsY5OEGsWyH6peAuwKFjHvdhtF5PG9+lOwh63EmXK:29hikvRya0AulzvdTFI9+lOws9XK
Malware Config
Extracted
Family
xworm
Version
5.0
C2
20.ip.gl.ply.gg:25905
pics-facial.gl.at.ply.gg:25905
Mutex
DbJdoPQAuynKdINr
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2824-1-0x0000000000A20000-0x0000000000A30000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2824 максим лох.exe Token: SeDebugPrivilege 3808 taskmgr.exe Token: SeSystemProfilePrivilege 3808 taskmgr.exe Token: SeCreateGlobalPrivilege 3808 taskmgr.exe Token: 33 3808 taskmgr.exe Token: SeIncBasePriorityPrivilege 3808 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe 3808 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\максим лох.exe"C:\Users\Admin\AppData\Local\Temp\максим лох.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3808