Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 02:37
Behavioral task
behavioral1
Sample
d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe
Resource
win10v2004-20240611-en
General
-
Target
d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe
-
Size
57KB
-
MD5
90a6868b7ce2020387d453aa38668584
-
SHA1
7bde411bb0d7b6aa7a020266a61ce0d61ef0b362
-
SHA256
d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a
-
SHA512
243c6010cbee28f5181383565a00c22375828f8b5293d35d9512adb249a4fadfd04eab3fb7b9789d6e1bea39f1cf513439e0f7d72ecb69e00a16e8f6d7f0efcc
-
SSDEEP
1536:Liu7HktvnRa+lZrOY/FJ9N76iOCweg662XkhiYYtG:LiftnZCgFJ9NTOCql2XkUYYtG
Malware Config
Extracted
xworm
5.0
hardware-bands.gl.at.ply.gg:63257
GRHeRJRFnCzlkxGI
-
Install_directory
%AppData%
-
install_file
DiscordAutoUpdate.exe
Signatures
-
Detect Xworm Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2340-1-0x0000000001390000-0x00000000013A4000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exe family_xworm behavioral1/memory/2184-36-0x0000000000B90000-0x0000000000BA4000-memory.dmp family_xworm behavioral1/memory/1664-39-0x0000000000370000-0x0000000000384000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2680 powershell.exe 2616 powershell.exe 2452 powershell.exe 2164 powershell.exe -
Drops startup file 2 IoCs
Processes:
d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordAutoUpdate.lnk d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordAutoUpdate.lnk d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe -
Executes dropped EXE 2 IoCs
Processes:
DiscordAutoUpdate.exeDiscordAutoUpdate.exepid process 2184 DiscordAutoUpdate.exe 1664 DiscordAutoUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordAutoUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\DiscordAutoUpdate.exe" d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exed2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exepid process 2680 powershell.exe 2616 powershell.exe 2452 powershell.exe 2164 powershell.exe 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exepowershell.exepowershell.exepowershell.exepowershell.exeDiscordAutoUpdate.exeDiscordAutoUpdate.exedescription pid process Token: SeDebugPrivilege 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 2616 powershell.exe Token: SeDebugPrivilege 2452 powershell.exe Token: SeDebugPrivilege 2164 powershell.exe Token: SeDebugPrivilege 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe Token: SeDebugPrivilege 2184 DiscordAutoUpdate.exe Token: SeDebugPrivilege 1664 DiscordAutoUpdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exepid process 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exetaskeng.exedescription pid process target process PID 2340 wrote to memory of 2680 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2680 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2680 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2616 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2616 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2616 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2452 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2452 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2452 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2164 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2164 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2164 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe powershell.exe PID 2340 wrote to memory of 2920 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe schtasks.exe PID 2340 wrote to memory of 2920 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe schtasks.exe PID 2340 wrote to memory of 2920 2340 d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe schtasks.exe PID 776 wrote to memory of 2184 776 taskeng.exe DiscordAutoUpdate.exe PID 776 wrote to memory of 2184 776 taskeng.exe DiscordAutoUpdate.exe PID 776 wrote to memory of 2184 776 taskeng.exe DiscordAutoUpdate.exe PID 776 wrote to memory of 1664 776 taskeng.exe DiscordAutoUpdate.exe PID 776 wrote to memory of 1664 776 taskeng.exe DiscordAutoUpdate.exe PID 776 wrote to memory of 1664 776 taskeng.exe DiscordAutoUpdate.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe"C:\Users\Admin\AppData\Local\Temp\d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'd2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DiscordAutoUpdate.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DiscordAutoUpdate" /tr "C:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\taskeng.exetaskeng.exe {C56986E1-86DC-4B4E-8E1A-1B24CA65B1BE} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exeC:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exeC:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exeFilesize
57KB
MD590a6868b7ce2020387d453aa38668584
SHA17bde411bb0d7b6aa7a020266a61ce0d61ef0b362
SHA256d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a
SHA512243c6010cbee28f5181383565a00c22375828f8b5293d35d9512adb249a4fadfd04eab3fb7b9789d6e1bea39f1cf513439e0f7d72ecb69e00a16e8f6d7f0efcc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD58a168c34b2571dd9a69d3085e08bf78a
SHA10126d1acac979f79c30211e6711ba17cbda4b4aa
SHA25609e7b1068055ca029e0fd128f9f622d8fa9db80098b697ed8623c4ca92e37133
SHA512665225543f321d5f93ef36570f85b367b949e74068f3ed8c410fba23708fd12ed3770c4535e3ea5e9e0c92e29c612527a7f8b796d8d86466cf3f8b861a84eec7
-
memory/1664-39-0x0000000000370000-0x0000000000384000-memory.dmpFilesize
80KB
-
memory/2184-36-0x0000000000B90000-0x0000000000BA4000-memory.dmpFilesize
80KB
-
memory/2340-31-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmpFilesize
4KB
-
memory/2340-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmpFilesize
4KB
-
memory/2340-32-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmpFilesize
9.9MB
-
memory/2340-2-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmpFilesize
9.9MB
-
memory/2340-1-0x0000000001390000-0x00000000013A4000-memory.dmpFilesize
80KB
-
memory/2616-15-0x000000001B570000-0x000000001B852000-memory.dmpFilesize
2.9MB
-
memory/2616-16-0x0000000002290000-0x0000000002298000-memory.dmpFilesize
32KB
-
memory/2680-9-0x0000000001F50000-0x0000000001F58000-memory.dmpFilesize
32KB
-
memory/2680-8-0x000000001B740000-0x000000001BA22000-memory.dmpFilesize
2.9MB
-
memory/2680-7-0x0000000002D00000-0x0000000002D80000-memory.dmpFilesize
512KB