General
-
Target
SCINSTALLER.exe
-
Size
15.8MB
-
Sample
240629-ts4fma1cmf
-
MD5
9fef698c512d5661717f0bf5ad97c165
-
SHA1
8a04d3c0c42725efcb3895cfa6bb4e76065705ae
-
SHA256
f568aecb2053d8f96a1e9638a83308d9271088d793a8373955ae0915901afa33
-
SHA512
cf595ef7a2f0be6e45c41582189c632829839c09103c54c056c3628fc36de8fa50766711f37ac02af80e54acbe5aab4d62ef67a4d40c84ee0c69352eccdae799
-
SSDEEP
393216:EKjbZBCC8qxl0ARCxhApMeQaHsWWWlbjJtKhPM1JRh:EKnZtLl0ARCxK+4Hs+lihU73
Static task
static1
Behavioral task
behavioral1
Sample
SCINSTALLER.exe
Resource
win10-20240404-en
Malware Config
Extracted
xworm
5.0
hardware-bands.gl.at.ply.gg:63257
GRHeRJRFnCzlkxGI
-
Install_directory
%AppData%
-
install_file
DiscordAutoUpdate.exe
Targets
-
-
Target
SCINSTALLER.exe
-
Size
15.8MB
-
MD5
9fef698c512d5661717f0bf5ad97c165
-
SHA1
8a04d3c0c42725efcb3895cfa6bb4e76065705ae
-
SHA256
f568aecb2053d8f96a1e9638a83308d9271088d793a8373955ae0915901afa33
-
SHA512
cf595ef7a2f0be6e45c41582189c632829839c09103c54c056c3628fc36de8fa50766711f37ac02af80e54acbe5aab4d62ef67a4d40c84ee0c69352eccdae799
-
SSDEEP
393216:EKjbZBCC8qxl0ARCxhApMeQaHsWWWlbjJtKhPM1JRh:EKnZtLl0ARCxK+4Hs+lihU73
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1