Analysis date (UTC): 14 August 2024, 17:10Analysis environment: Windows 10 Pro, build 19045, x64

Stake Predictor.exe

MD5:40DCE78E72534163E4098A139B9F538A

SHA1:66D810B233C330435930F5A3ADBC7D20763C63A4

SHA256:EB5A000AD896A8A481002F1AC7A683D4594506DAC3D9A7112A52BB3DB099504B

Analysis result

Threat level:Malicious activity

Tags:

evasionxwormremotecrypto-regex

Full analysis:Analysis Stake Predictor.exe (MD5: 40DCE78E72534163E4098A139B9F538A) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Uses Task Scheduler to run other applications

XpiViewer.exe (PID: 6376)

Create files in the Startup directory

XpiViewer.exe (PID: 6376)

XWORM has been detected (SURICATA)

XpiViewer.exe (PID: 6376)

XWORM has been detected (YARA)

XpiViewer.exe (PID: 6376)

Changes the autorun value in the registry

XpiViewer.exe (PID: 6376)

Connects to the CnC server

XpiViewer.exe (PID: 6376)

SUSPICIOUS

Executable content was dropped or overwritten

Stake Predictor.exe (PID: 6308)
XpiViewer.exe (PID: 6376)

Reads security settings of Internet Explorer

Stake Predictor.exe (PID: 6308)
XpiViewer.exe (PID: 6376)

Reads the date of Windows installation

Stake Predictor.exe (PID: 6308)
XpiViewer.exe (PID: 6376)

Drops the executable file immediately after the start

Stake Predictor.exe (PID: 6308)
XpiViewer.exe (PID: 6376)

Contacting a server suspected of hosting an CnC

XpiViewer.exe (PID: 6376)

Checks for external IP

svchost.exe (PID: 2256)
XpiViewer.exe (PID: 6376)

Found regular expressions for crypto-addresses (YARA)

XpiViewer.exe (PID: 6376)

Connects to unusual port

XpiViewer.exe (PID: 6376)

The process executes via Task Scheduler

XPI.exe (PID: 6192)

INFO

Creates files or folders in the user directory

Stake Predictor.exe (PID: 6308)
XpiViewer.exe (PID: 6376)

Reads the machine GUID from the registry

Stake Predictor.exe (PID: 6308)
XpiViewer.exe (PID: 6376)
Stake.exe (PID: 6360)
XPI.exe (PID: 6192)

Process checks computer location settings

Stake Predictor.exe (PID: 6308)
XpiViewer.exe (PID: 6376)

Checks supported languages

Stake Predictor.exe (PID: 6308)
Stake.exe (PID: 6360)
XpiViewer.exe (PID: 6376)
XPI.exe (PID: 6192)

Reads the computer name

Stake Predictor.exe (PID: 6308)
XpiViewer.exe (PID: 6376)
Stake.exe (PID: 6360)
XPI.exe (PID: 6192)

Reads Environment values

XpiViewer.exe (PID: 6376)

Disables trace logs

XpiViewer.exe (PID: 6376)

Checks proxy server information

XpiViewer.exe (PID: 6376)

Reads the software policy settings

XpiViewer.exe (PID: 6376)

Threats

PID	Process	Class	Message
2256	svchost.exe	Device Retrieving External IP Address Detected	INFO [ANY.RUN] External IP Check (ip-api .com)
2256	svchost.exe	Device Retrieving External IP Address Detected	ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6376	XpiViewer.exe	Device Retrieving External IP Address Detected	ET POLICY External IP Lookup ip-api.com
6376	XpiViewer.exe	Device Retrieving External IP Address Detected	POLICY [ANY.RUN] External Hosting Lookup by ip-api
6376	XpiViewer.exe	Malware Command and Control Activity Detected	REMOTE [ANY.RUN] Xworm TCP Packet