Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 04:21
Behavioral task
behavioral1
Sample
f537e878065dbdfb04fa5382bf82b1ab.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
f537e878065dbdfb04fa5382bf82b1ab.exe
Resource
win10v2004-20240508-en
General
-
Target
f537e878065dbdfb04fa5382bf82b1ab.exe
-
Size
173KB
-
MD5
f537e878065dbdfb04fa5382bf82b1ab
-
SHA1
21c67ae027f5b1db7d84a93433bc17b1f5826151
-
SHA256
f1d31c22c3cd5ea68f7929947784806fb5f9d48ce35f7133351f743d870aa223
-
SHA512
02e80c6f24e56091e747732bfe2025ab39a62cd9a6eaa50fcd3b26a57451dc159c23af9357ee88a8dd08926c9bed4f168e8ef37cf40d8ca2e75c8b61afec26a3
-
SSDEEP
3072:mMSwuonS8fqbBohj4UQOWqUAdBz65/M6If+3Js+3JFkKeTn6:mMS3onSrb6hj4UXdxBt25
Malware Config
Extracted
xworm
127.0.0.1:57677
Azuu-57677.portmap.io:57677
-
Install_directory
%Temp%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3024-1-0x0000000001110000-0x0000000001142000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\Temp\svchost.exe family_xworm behavioral1/memory/2096-37-0x00000000011B0000-0x00000000011E2000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2836 powershell.exe 2540 powershell.exe 2212 powershell.exe 2748 powershell.exe -
Drops startup file 2 IoCs
Processes:
f537e878065dbdfb04fa5382bf82b1ab.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk f537e878065dbdfb04fa5382bf82b1ab.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk f537e878065dbdfb04fa5382bf82b1ab.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 2096 svchost.exe 1088 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f537e878065dbdfb04fa5382bf82b1ab.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe" f537e878065dbdfb04fa5382bf82b1ab.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exef537e878065dbdfb04fa5382bf82b1ab.exepid process 2748 powershell.exe 2836 powershell.exe 2540 powershell.exe 2212 powershell.exe 3024 f537e878065dbdfb04fa5382bf82b1ab.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
f537e878065dbdfb04fa5382bf82b1ab.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 3024 f537e878065dbdfb04fa5382bf82b1ab.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeDebugPrivilege 2836 powershell.exe Token: SeDebugPrivilege 2540 powershell.exe Token: SeDebugPrivilege 2212 powershell.exe Token: SeDebugPrivilege 3024 f537e878065dbdfb04fa5382bf82b1ab.exe Token: SeDebugPrivilege 2096 svchost.exe Token: SeDebugPrivilege 1088 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
f537e878065dbdfb04fa5382bf82b1ab.exepid process 3024 f537e878065dbdfb04fa5382bf82b1ab.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
f537e878065dbdfb04fa5382bf82b1ab.exetaskeng.exedescription pid process target process PID 3024 wrote to memory of 2748 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2748 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2748 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2836 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2836 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2836 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2540 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2540 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2540 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2212 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2212 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2212 3024 f537e878065dbdfb04fa5382bf82b1ab.exe powershell.exe PID 3024 wrote to memory of 2968 3024 f537e878065dbdfb04fa5382bf82b1ab.exe schtasks.exe PID 3024 wrote to memory of 2968 3024 f537e878065dbdfb04fa5382bf82b1ab.exe schtasks.exe PID 3024 wrote to memory of 2968 3024 f537e878065dbdfb04fa5382bf82b1ab.exe schtasks.exe PID 752 wrote to memory of 2096 752 taskeng.exe svchost.exe PID 752 wrote to memory of 2096 752 taskeng.exe svchost.exe PID 752 wrote to memory of 2096 752 taskeng.exe svchost.exe PID 752 wrote to memory of 1088 752 taskeng.exe svchost.exe PID 752 wrote to memory of 1088 752 taskeng.exe svchost.exe PID 752 wrote to memory of 1088 752 taskeng.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f537e878065dbdfb04fa5382bf82b1ab.exe"C:\Users\Admin\AppData\Local\Temp\f537e878065dbdfb04fa5382bf82b1ab.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\f537e878065dbdfb04fa5382bf82b1ab.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'f537e878065dbdfb04fa5382bf82b1ab.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\taskeng.exetaskeng.exe {7F1F2E07-10F4-492E-B42A-CA0877FEAB48} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
173KB
MD5f537e878065dbdfb04fa5382bf82b1ab
SHA121c67ae027f5b1db7d84a93433bc17b1f5826151
SHA256f1d31c22c3cd5ea68f7929947784806fb5f9d48ce35f7133351f743d870aa223
SHA51202e80c6f24e56091e747732bfe2025ab39a62cd9a6eaa50fcd3b26a57451dc159c23af9357ee88a8dd08926c9bed4f168e8ef37cf40d8ca2e75c8b61afec26a3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5d3cb707eaa9de46a8ea7c498e49cc6a9
SHA10fd875e4bd28f6ec63a4c1d8a107fe6a9f55dcee
SHA2560be1c95e8511dcc9930fd79f654b4522769292988ea81d8837cb0cece4d3aa29
SHA512c825dd3779be3e05b38611df73227e8bff310b14082cfcb2a73ecdd4fab3185739570f59bdf203b92d4162c93f91d80798bb6c0ec97dfa29635b3952460a8284
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2096-37-0x00000000011B0000-0x00000000011E2000-memory.dmpFilesize
200KB
-
memory/2748-7-0x0000000002D20000-0x0000000002DA0000-memory.dmpFilesize
512KB
-
memory/2748-8-0x000000001B510000-0x000000001B7F2000-memory.dmpFilesize
2.9MB
-
memory/2748-9-0x0000000002810000-0x0000000002818000-memory.dmpFilesize
32KB
-
memory/2836-15-0x000000001B590000-0x000000001B872000-memory.dmpFilesize
2.9MB
-
memory/2836-16-0x0000000002340000-0x0000000002348000-memory.dmpFilesize
32KB
-
memory/3024-2-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmpFilesize
9.9MB
-
memory/3024-0-0x000007FEF5533000-0x000007FEF5534000-memory.dmpFilesize
4KB
-
memory/3024-32-0x000007FEF5533000-0x000007FEF5534000-memory.dmpFilesize
4KB
-
memory/3024-33-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmpFilesize
9.9MB
-
memory/3024-1-0x0000000001110000-0x0000000001142000-memory.dmpFilesize
200KB