General
-
Target
SCINSTALLER.exe
-
Size
15.8MB
-
Sample
240629-tyjcms1dna
-
MD5
eeb2753555dacb5baf2845522740627d
-
SHA1
0d0cb6b3d5d9e126f6ae60f60d0ac8cbe164ef33
-
SHA256
29e587daa7349fb2b43549afa499283b8449daea51365d2bba22a2bfe727fc75
-
SHA512
4839507182bda9a2f782da5e5be30f9fae167cdce2a78d8bab3df3cb321fab7c1c3ef2b28e0a079f75a29c27df5b5b1bbaddf75852450a1691f3137521655070
-
SSDEEP
393216:zKjbZBCC8qxl0ARCxhApMeQaHsWWWlbjJtKhPM1JR9:zKnZtLl0ARCxK+4Hs+lihU7n
Static task
static1
Behavioral task
behavioral1
Sample
SCINSTALLER.exe
Resource
win10-20240404-en
Malware Config
Extracted
xworm
5.0
hardware-bands.gl.at.ply.gg:63257
GRHeRJRFnCzlkxGI
-
Install_directory
%AppData%
-
install_file
DiscordAutoUpdate.exe
Targets
-
-
Target
SCINSTALLER.exe
-
Size
15.8MB
-
MD5
eeb2753555dacb5baf2845522740627d
-
SHA1
0d0cb6b3d5d9e126f6ae60f60d0ac8cbe164ef33
-
SHA256
29e587daa7349fb2b43549afa499283b8449daea51365d2bba22a2bfe727fc75
-
SHA512
4839507182bda9a2f782da5e5be30f9fae167cdce2a78d8bab3df3cb321fab7c1c3ef2b28e0a079f75a29c27df5b5b1bbaddf75852450a1691f3137521655070
-
SSDEEP
393216:zKjbZBCC8qxl0ARCxhApMeQaHsWWWlbjJtKhPM1JR9:zKnZtLl0ARCxK+4Hs+lihU7n
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1