Analysis
-
max time kernel
32s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2025, 10:59
General
-
Target
Steam.exe
-
Size
146KB
-
MD5
efcdd89ce48a4a1c856dbd2526f872fb
-
SHA1
a96626a12d24c0bce4bce65f6226580e69713ffe
-
SHA256
ca3b14261b2aec92409905ecfe956ed544908f3651f04bf19dbcfdcc235063a4
-
SHA512
74bffba125852c62eabd2781b67f638d140e61f4abead64c2b6adffdfcfbb2d054598798f8ef4a41208b46838009e821558245b8a05bc47399beb9621c6c7d7c
-
SSDEEP
1536:r1RGEW6DtIMaHWUDNhKGbMhIGIpUJL637OlDBdP7zZfUm7IZx+P32gTNTwhfdDp:r1LXtC/MGbMhk7OlDf3Zj7Iq+gJTefr
Malware Config
Extracted
Family
xworm
C2
some-event.gl.at.ply.gg:47661
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/4728-1-0x0000000000F80000-0x0000000000FAA000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 32 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4728 Steam.exe Token: SeDebugPrivilege 4904 taskmgr.exe Token: SeSystemProfilePrivilege 4904 taskmgr.exe Token: SeCreateGlobalPrivilege 4904 taskmgr.exe Token: 33 4904 taskmgr.exe Token: SeIncBasePriorityPrivilege 4904 taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Steam.exe"C:\Users\Admin\AppData\Local\Temp\Steam.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4904