Analysis
-
max time kernel
66s -
max time network
67s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
05/03/2025, 20:45
Static task
static1
1 signatures
General
-
Target
resthiemailmatrix.hub.exe
-
Size
118KB
-
MD5
7fc47d0f79e8bbb131e947beb67538ef
-
SHA1
b374cf5bfa41740e6a541e1f558a9e400720493a
-
SHA256
70fdf77f0aaca97b95c87bd9f31b0dda0f5c552b156e3788c9768dace10837f1
-
SHA512
9d5b848d0c9075b2240d7fbda92346a5a9506e9a0689f47e185be4998442fba14f2854dfe4f794dc6bb8dbdad66927ae3fe20a3e92945b81367ddc8c9661ecb2
-
SSDEEP
1536:cQowDILgxGY+lzyUF5g/PE3CfLSFUdo+e/erRMRsI0PiCxdm6fueNWa/FFr2DYi:1pGY+l1OUaLSFR+nsm5r+F
Malware Config
Extracted
Family
xworm
Version
5.0
C2
paul-nw.gl.at.ply.gg:3111
Mutex
F4I7I2sWyinFgipq
Attributes
-
Install_directory
%AppData%
-
install_file
kev.exe
aes.plain
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x000c000000027d85-10.dat family_xworm behavioral1/memory/1748-21-0x0000000000460000-0x0000000000470000-memory.dmp family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1095212214-1383118828-1037266802-1000\Control Panel\International\Geo\Nation resthiemailmatrix.hub.exe -
Executes dropped EXE 1 IoCs
pid Process 1748 .exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1748 .exe Token: SeDebugPrivilege 1816 taskmgr.exe Token: SeSystemProfilePrivilege 1816 taskmgr.exe Token: SeCreateGlobalPrivilege 1816 taskmgr.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe -
Suspicious use of SendNotifyMessage 55 IoCs
pid Process 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe 1816 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5012 wrote to memory of 1748 5012 resthiemailmatrix.hub.exe 82 PID 5012 wrote to memory of 1748 5012 resthiemailmatrix.hub.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\resthiemailmatrix.hub.exe"C:\Users\Admin\AppData\Local\Temp\resthiemailmatrix.hub.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\.exe"C:\Users\Admin\AppData\Local\Temp\.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5db139c53ad9a95a2e5069e4bb9ee0bc5
SHA196bf971116c728ac130d456d080982108c440cbd
SHA256617b0d7883b08e1f1e09dd6279661bb161bb6d29a0126527dbabae36183e4de0
SHA512a1a235a88a0f68af07963a2629b68db1b03d26caaab5afcf03c288fbb6f4f49683d295375921831ce0a48a64fbe1e0ba2f94871ab030080b1f995ef1a9f5cff4