xorium_stealer | 279811a1913a83c9d000835c161523cfcb0001489c0f21d62e69c08074bfe3af

General

Target
svchost.exe
Size 254KB
Sample261006-mxv7gsfv7w
SHA256 279811a1913a83c9d000835c161523cfcb0001489c0f21d62e69c08074bfe3af
MD5 3cdd17eac36f13f2ddcceb027dbcb86c
SHA1 d1dd015b243098f28ce38717549841faea8dec73
SHA512 fab7711f46a3581d81a6d9bca61e5722158af065d92c067d6a0d25d2812baffcaaebb9d10fe55c2ac5bb5c315cc986133f306bea6ebcd37f84042920a5163666
SSDEEP 6144:Kc08m+Rm8FAbxoQAEipx6D2WL/rKYITHK:/08m+dFAbxv2WLfT
TLSH
T1C9444B6433FC0A00F3BF8B34A9B4555446B6F92AE916D74D1D9238DD6E32B91AD20B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery xorium_stealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

xorium_stealer

C2

https://api.telegram.org/bot8995746355:AAGR17fQgFHNxtsMppgCY2zdsYxL62JdmdY/sendDocument

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36

Signatures

Family: XoriumStealer
XoriumStealer is an information stealer written in C#.
stealer xorium_stealer

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	svchost.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	icanhazip.com
5	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4768	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4756	svchost.exe
4756	svchost.exe
4756	svchost.exe
4756	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	svchost.exe
Token: SeDebugPrivilege	4756	svchost.exe
Token: SeDebugPrivilege	4756	svchost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 3936	4756	svchost.exe	89
PID 4756 wrote to memory of 4768	4756	svchost.exe	91

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Executes a file named after a Windows system binary
- Accesses Microsoft Outlook profiles
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4756
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\IntelixWifiExport_bc149e02e0964079a804ceca7a748241"
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3936
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Masquerading

1

T1036

Match Legitimate Name or Location

1

T1036.005

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

1

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Browser Information Discovery

1

T1217

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Network Configuration Discovery

3

T1016

Internet Connection Discovery

1

T1016.001

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i050kmdt.xof

Path C:\Users\Admin\AppData\Local\Temp\i050kmdt.xof
Size 8KB
SHA256 9e4412ef78b138fe47740e840614d0a96500f8f325759a347b93a8781bda2fc8
MD5 a516e0bb4b038821c751089eddf82971
SHA1 3f56db24511ca678e6dad90c752721e9413559c3
SHA512 f967d03a7a697572e0c0f17adc23baabac109cc293c1ba5f4b0d11c54e1f96d368c2b5e2c16cc691f2ea265b75090e3625ba429e83ea7882d9e4a4b604541ce2
SSDEEP 96:KqONk0QsjpfbUmjH5ih/cIPURHl8h4otop5PaD3BKP4v+Y1xf//ojdixHeYMyw3N:BONU6JUm0QmiUykxso//gyw3ECy3e
TLSH
T1BD02C835BC28BC7B9EF2AE45B0477B239FA4107BAA951F44DAD91E2D01D715C1302C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lbglvxfb.quy

Path C:\Users\Admin\AppData\Local\Temp\lbglvxfb.quy
Size 130KB
SHA256 0a8e873dca97e87104228dae1978099f74b732c8eae6a92d200646603ac9589f
MD5 a7bf935ce45aa8604003216d78c326fa
SHA1 d91b6865c96f68740a5c06baeee32d63b08d4296
SHA512 1dddd0dbc5fa95cb560adad8675018474fb984546e45765ef46b9acecd9b6505ccd73c26e17bbdae640f2561a1dc5e867f4bda33e98f1ee95742bec7bf3fef97
SSDEEP 3072:13J+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dJ+hFD+7t56OD9ZfSApprr
TLSH
T12CD31232AA95D8BBC9FC6541B157A300DE7668ED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4756-0-0x000001C396BE0000-0x000001C396C24000-memory.dmp

Download

memory/4756-11-0x000001C3B4F30000-0x000001C3B4F80000-memory.dmp

Download

memory/4756-12-0x000001C3B25E0000-0x000001C3B25F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads