Analysis
-
max time kernel
899s -
max time network
543s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
06/04/2025, 13:10
General
-
Target
Searials Spoofer v2.exe
-
Size
303KB
-
MD5
1c31295968b6cadd0f0828a85de98046
-
SHA1
485d86876882d6fdee9702c0b187505e4ea40052
-
SHA256
b71c16539f53b983dda629c462fc73870a9bf0b0540e2519df095c59510bcf65
-
SHA512
239e69ae8b59fb45d1c065f18511b3aea7a88d0dcf7496498e3d827c4f0bfaa24c0f16714a0a770953fdd67542d39ea2728167b4f3a58227397a72e77e53302b
-
SSDEEP
6144:xdl9iZryT1R/eZp06ntBfX4MYsPOAtvjDukP0mcu:zR/SLnsbsZtekx
Malware Config
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
Mutex
7qYyGvaCPCzZBzRk
Attributes
-
Install_directory
%AppData%
-
install_file
Spoofer.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/544-1-0x00000000004A0000-0x00000000004F2000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4916 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 544 Searials Spoofer v2.exe Token: SeDebugPrivilege 4916 taskmgr.exe Token: SeSystemProfilePrivilege 4916 taskmgr.exe Token: SeCreateGlobalPrivilege 4916 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Searials Spoofer v2.exe"C:\Users\Admin\AppData\Local\Temp\Searials Spoofer v2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:544
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4916