Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
07/03/2025, 04:15
General
-
Target
colorbot UD.exe
-
Size
66KB
-
MD5
3c29f913ec259219393ed6ed34095f7f
-
SHA1
a44d686af7756b548373525b3cb921c44d0b67b2
-
SHA256
e65c82b121ec90f36fc4193e8e7f850312107c441e8a2cfa4e6b844cb6462485
-
SHA512
3a3e5a676a0541b9d5697c5f6f7b71deadae1e9633ff919cfdf68f9288f4b5dfb91c38a6af0fbbe23aaab5d08e1b6f409bf33134390a54ca023c916f3d5ecf50
-
SSDEEP
1536:vFVqX0n8XtajJvNDbsPSKoZr66tFOgUu9x6:9Yq8XQBbsT0FO7j
Malware Config
Extracted
Family
xworm
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/kU06s0Rk
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/1092-1-0x0000000000640000-0x0000000000656000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1092 colorbot UD.exe Token: SeDebugPrivilege 2848 taskmgr.exe Token: SeSystemProfilePrivilege 2848 taskmgr.exe Token: SeCreateGlobalPrivilege 2848 taskmgr.exe Token: 33 2848 taskmgr.exe Token: SeIncBasePriorityPrivilege 2848 taskmgr.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe -
Suspicious use of SendNotifyMessage 41 IoCs
pid Process 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\colorbot UD.exe"C:\Users\Admin\AppData\Local\Temp\colorbot UD.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2848