Overview

overview

10

Static

static

10

awdawwadient.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    awdawwadient.exe

  • Size

    63KB

  • Sample

    240428-gzmp8saa21

  • MD5

    dfba7bc7b3ca3fde12cb85be938d8879

  • SHA1

    4244d7943ff69e4be30807dabf825689aa09723b

  • SHA256

    f673ca8fe66349501805ff6a34190bf8f1bcbbf4334b9e7274446df883bd4148

  • SHA512

    b5e6b0878652904011c82f07a96d867a835558a92266545e298bf84075c4c0b2a666bd019c2e491c38b4a1ed4919b8af8bd3dad0f7eaa92cc7c4d647bc97cd11

  • SSDEEP

    1536:1JWTjPfI9X4Eep8phhYaN2msZbsUN+1O5Oz4zfzRxt:1YTjPi438phqM2nZbsnO5Oz4zL/t

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

3.1

C2

172.200.210.28:80

Attributes
  • Install_directory

    %Public%

  • install_file

    USB.exe

Targets

    • Target

      awdawwadient.exe

    • Size

      63KB

    • MD5

      dfba7bc7b3ca3fde12cb85be938d8879

    • SHA1

      4244d7943ff69e4be30807dabf825689aa09723b

    • SHA256

      f673ca8fe66349501805ff6a34190bf8f1bcbbf4334b9e7274446df883bd4148

    • SHA512

      b5e6b0878652904011c82f07a96d867a835558a92266545e298bf84075c4c0b2a666bd019c2e491c38b4a1ed4919b8af8bd3dad0f7eaa92cc7c4d647bc97cd11

    • SSDEEP

      1536:1JWTjPfI9X4Eep8phhYaN2msZbsUN+1O5Oz4zfzRxt:1YTjPi438phqM2nZbsnO5Oz4zL/t

    Score
    10/10
    xwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks