Analysis
-
max time kernel
55s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 20:26
Behavioral task
behavioral1
Sample
gjruheigerg.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
gjruheigerg.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
gjruheigerg.exe
Resource
win10v2004-20240226-en
General
-
Target
gjruheigerg.exe
-
Size
84KB
-
MD5
b5fbb4aec5eaf3f64a592e72ac30a1ab
-
SHA1
993b36feeb223032ec7a536687cfe37ddf2ffd39
-
SHA256
ca608f15c34d7526591d75a76d1a29ef03e17c133ef2dfb7dda09be631d0e449
-
SHA512
8768a68783e11654da0815b574e7e20c3cdaa4b4f710b6d288f9a69082f040177d32b2fdaf34b42239308ea21d4e3fc4319b67145b0f2b8126a4fc7a007dcc53
-
SSDEEP
1536:Xb5H+OMwTEBrZ5idVjzXGbhpTw6DG6GiyoAOsjJKVV4yAETSAJ0iH:rgG0FkbH2bhpM6NAOsViyylyY
Malware Config
Extracted
xworm
79.202.250.5:80
-
Install_directory
%Temp%
-
install_file
discord_autoupdaterconfifm.exe
-
telegram
https://api.telegram.org/bot7345950584:AAH5ca8n_1S4bD12cZuSsr23SjFGXJYzRk0
Signatures
-
Detect Xworm Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1908-1-0x00000000003A0000-0x00000000003BC000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\Temp\discord_autoupdaterconfifm.exe family_xworm behavioral1/memory/764-33-0x0000000000380000-0x000000000039C000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2444 powershell.exe 2696 powershell.exe 2700 powershell.exe 2564 powershell.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1972 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
discord_autoupdaterconfifm.exepid process 764 discord_autoupdaterconfifm.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1536 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exegjruheigerg.exepid process 2564 powershell.exe 2444 powershell.exe 2696 powershell.exe 2700 powershell.exe 1908 gjruheigerg.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
gjruheigerg.exepowershell.exepowershell.exepowershell.exepowershell.exediscord_autoupdaterconfifm.exedescription pid process Token: SeDebugPrivilege 1908 gjruheigerg.exe Token: SeDebugPrivilege 2564 powershell.exe Token: SeDebugPrivilege 2444 powershell.exe Token: SeDebugPrivilege 2696 powershell.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeDebugPrivilege 1908 gjruheigerg.exe Token: SeDebugPrivilege 764 discord_autoupdaterconfifm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
gjruheigerg.exepid process 1908 gjruheigerg.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
gjruheigerg.exetaskeng.execmd.exedescription pid process target process PID 1908 wrote to memory of 2564 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2564 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2564 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2444 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2444 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2444 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2696 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2696 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2696 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2700 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2700 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 2700 1908 gjruheigerg.exe powershell.exe PID 1908 wrote to memory of 1936 1908 gjruheigerg.exe schtasks.exe PID 1908 wrote to memory of 1936 1908 gjruheigerg.exe schtasks.exe PID 1908 wrote to memory of 1936 1908 gjruheigerg.exe schtasks.exe PID 1784 wrote to memory of 764 1784 taskeng.exe discord_autoupdaterconfifm.exe PID 1784 wrote to memory of 764 1784 taskeng.exe discord_autoupdaterconfifm.exe PID 1784 wrote to memory of 764 1784 taskeng.exe discord_autoupdaterconfifm.exe PID 1908 wrote to memory of 324 1908 gjruheigerg.exe schtasks.exe PID 1908 wrote to memory of 324 1908 gjruheigerg.exe schtasks.exe PID 1908 wrote to memory of 324 1908 gjruheigerg.exe schtasks.exe PID 1908 wrote to memory of 1972 1908 gjruheigerg.exe cmd.exe PID 1908 wrote to memory of 1972 1908 gjruheigerg.exe cmd.exe PID 1908 wrote to memory of 1972 1908 gjruheigerg.exe cmd.exe PID 1972 wrote to memory of 1536 1972 cmd.exe timeout.exe PID 1972 wrote to memory of 1536 1972 cmd.exe timeout.exe PID 1972 wrote to memory of 1536 1972 cmd.exe timeout.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\gjruheigerg.exe"C:\Users\Admin\AppData\Local\Temp\gjruheigerg.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\gjruheigerg.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'gjruheigerg.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\discord_autoupdaterconfifm.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord_autoupdaterconfifm.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "discord_autoupdaterconfifm" /tr "C:\Users\Admin\AppData\Local\Temp\discord_autoupdaterconfifm.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "discord_autoupdaterconfifm"2⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD94F.tmp.bat""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\taskeng.exetaskeng.exe {63705E6E-5E92-4DF7-BB3D-BC35A01EE364} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\discord_autoupdaterconfifm.exeC:\Users\Admin\AppData\Local\Temp\discord_autoupdaterconfifm.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\discord_autoupdaterconfifm.exeFilesize
84KB
MD5b5fbb4aec5eaf3f64a592e72ac30a1ab
SHA1993b36feeb223032ec7a536687cfe37ddf2ffd39
SHA256ca608f15c34d7526591d75a76d1a29ef03e17c133ef2dfb7dda09be631d0e449
SHA5128768a68783e11654da0815b574e7e20c3cdaa4b4f710b6d288f9a69082f040177d32b2fdaf34b42239308ea21d4e3fc4319b67145b0f2b8126a4fc7a007dcc53
-
C:\Users\Admin\AppData\Local\Temp\tmpD94F.tmp.batFilesize
163B
MD52295303fb3b4c18d6bee4211823e1ef5
SHA198e3ca90035a7fc624b05b8f90b0c3af0be88925
SHA256ea217185e4263be780b5c2733ccef0d47baac77d915a12463de70d573d1b74ec
SHA51202a00cbb483dcbd60f15799acdcacebff9a0387d0a6b0aafcacb04078d4030927d65c4407ae090a835ebf2345379a94d89dd63e4ab82ea31867bea09fc28245b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5acdbf99d0df60c1f7e17e7ffe3dc64e8
SHA13a32a7583ed3fb9483b17060c98a5c3356bb59c0
SHA25696272cadd55d02ac599ae459e529e525810f32b9d9aef33fb056a782e4367fdf
SHA512db9d2df1a12675f6531716af3af50114eb17e02a38c68c695ce5194a0a4818c64f60955e5f9694cba1ef99752c3377733f6cd7c1d71c658dde12468a2b25265a
-
memory/764-33-0x0000000000380000-0x000000000039C000-memory.dmpFilesize
112KB
-
memory/1908-28-0x000007FEF5043000-0x000007FEF5044000-memory.dmpFilesize
4KB
-
memory/1908-0-0x000007FEF5043000-0x000007FEF5044000-memory.dmpFilesize
4KB
-
memory/1908-29-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmpFilesize
9.9MB
-
memory/1908-2-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmpFilesize
9.9MB
-
memory/1908-1-0x00000000003A0000-0x00000000003BC000-memory.dmpFilesize
112KB
-
memory/1908-42-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmpFilesize
9.9MB
-
memory/2444-15-0x000000001B5A0000-0x000000001B882000-memory.dmpFilesize
2.9MB
-
memory/2444-16-0x0000000002760000-0x0000000002768000-memory.dmpFilesize
32KB
-
memory/2564-9-0x00000000028E0000-0x00000000028E8000-memory.dmpFilesize
32KB
-
memory/2564-8-0x000000001B600000-0x000000001B8E2000-memory.dmpFilesize
2.9MB
-
memory/2564-7-0x0000000002810000-0x0000000002890000-memory.dmpFilesize
512KB