Windows
Analysis Report
185.7.214_1.54.ps1
Overview
General Information
| Sample name: | 185.7.214_1.54.ps1 |
| Analysis ID: | 1614035 |
| MD5: | 5ba7043c21494f72d216868f32e70373 |
| SHA1: | f0831034083a99ccdc2655d3361da4ed65cec3a1 |
| SHA256: | 80a21952b87d83eb419768268b334364ecab48dbb9cbe55b967ba9636e512cab |
| Tags: | 185-7-214-54bookingps1user-JAMESWT_MHT |
| Infos: |   |
 |
|
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large strings
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Compiles code for process injection (via .Net compiler)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Writes to foreign memory regions
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
|
AV Detection |
  |
|---|
| Source: |
Avira URL Cloud: |
||
| Source: |
Avira URL Cloud: |
||
| Source: |
Avira: |
||
| Source: |
Malware Configuration Extractor: |
||
| Source: |
Integrated Neural Analysis Model: |
||
| Source: |
String decryptor: |
||
| Source: |
String decryptor: |
||
| Source: |
String decryptor: |
||
| Source: |
String decryptor: |
||
| Source: |
String decryptor: |
||
| Source: |
String decryptor: |
||
| Source: |
Binary string: |
||
Networking |
|
|---|
| Source: |
Suricata IDS: |
||
| Source: |
Suricata IDS: |
||
| Source: |
Suricata IDS: |
||
| Source: |
Suricata IDS: |
||
| Source: |
Suricata IDS: |
||
| Source: |
URLs: |
||
| Source: |
TCP traffic: |
||
| Source: |
TCP traffic: |
||
| Source: |
HTTP traffic detected: | ||