e902bd20f12010f533a624942623b29f00a07430b3b1b44c53ddc72251a6926f

Analysis

max time kernel
30s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2022 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm-RAT-main/XWorm RAT V2.1/XWorm-RAT-V2.1-builder.exe
Size

3.2MB
MD5

6925453f1a0ba21cb5559eb60aa454c2
SHA1

f41d894c216079a1d410747d28a1b2017a7e5601
SHA256

eeaf8ab27825be4133d2bef1fb9db23b23edade4b21c31976aefe66807eac93a
SHA512

aa2a6379b6e7489cdbb10a46af7c362d5e6ab826935807bfa37d08e7aa6a79b29f7ff9b95f1777a321b99c98ef95e1084d38997e106c04f3975004689a246873
SSDEEP

24576:t08GeFzFDzPLDP8c1uAowyLQfB/eVjKIOQaBcM707ae8gpeJF+kR8YD2Y35lBIWf:N/TjrHWKWDOQko29ueJsq8if9

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

XWorm-RAT-V2.1-builder.exe

pid process

4720 XWorm-RAT-V2.1-builder.exe

pid	process
4720	XWorm-RAT-V2.1-builder.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

XWorm-RAT-V2.1-builder.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	XWorm-RAT-V2.1-builder.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1424 4720 WerFault.exe XWorm-RAT-V2.1-builder.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

XWorm-RAT-V2.1-builder.exe

pid process

4720 XWorm-RAT-V2.1-builder.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

XWorm-RAT-V2.1-builder.exeXWorm-RAT-V2.1-builder.exe

description pid process

Token: SeDebugPrivilege 4988 XWorm-RAT-V2.1-builder.exe
Token: SeDebugPrivilege 4720 XWorm-RAT-V2.1-builder.exe

pid	pid_target	process	target process
1424	4720	WerFault.exe	XWorm-RAT-V2.1-builder.exe

pid	process
4720	XWorm-RAT-V2.1-builder.exe

description	pid	process
Token: SeDebugPrivilege	4988	XWorm-RAT-V2.1-builder.exe
Token: SeDebugPrivilege	4720	XWorm-RAT-V2.1-builder.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

XWorm-RAT-V2.1-builder.exe

description	pid	process	target process
PID 4988 wrote to memory of 4720	4988	XWorm-RAT-V2.1-builder.exe	XWorm-RAT-V2.1-builder.exe
PID 4988 wrote to memory of 4720	4988	XWorm-RAT-V2.1-builder.exe	XWorm-RAT-V2.1-builder.exe

C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-main\XWorm RAT V2.1\XWorm-RAT-V2.1-builder.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-main\XWorm RAT V2.1\XWorm-RAT-V2.1-builder.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988

C:\Users\Admin\AppData\Local\Temp\IT6P884R-6NT1-17KU-DG15-V62CV59B\XWorm-RAT-V2.1-builder.exe
"C:\Users\Admin\AppData\Local\Temp\IT6P884R-6NT1-17KU-DG15-V62CV59B\XWorm-RAT-V2.1-builder.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4720 -s 1392
3⤵
- Program crash
PID:1424

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4720 -ip 4720
1⤵
PID:3444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWorm-RAT-V2.1-builder.exe.log
Filesize
1KB

MD5
ef001c9a7396b37a66898e7664dd413c

SHA1
d21053a6563bcc49e88f8f16c0fa07f8a9b901e0

SHA256
e5fc32e12bcbaf588b8c4265a8679331ff1d4f0f454452c24afb34e0b19eff59

SHA512
348346791b277c66fc72f5f5045b662fbedb08bf4a19b685c38b5dc3b30797994840dcca643f3961122dc97f76ca0fbab8e6fad60f52c7eb11b6a0e9e5ffe886

Download Submit
C:\Users\Admin\AppData\Local\Temp\IT6P884R-6NT1-17KU-DG15-V62CV59B\XWorm-RAT-V2.1-builder.exe
Filesize
3.2MB

MD5
6925453f1a0ba21cb5559eb60aa454c2

SHA1
f41d894c216079a1d410747d28a1b2017a7e5601

SHA256
eeaf8ab27825be4133d2bef1fb9db23b23edade4b21c31976aefe66807eac93a

SHA512
aa2a6379b6e7489cdbb10a46af7c362d5e6ab826935807bfa37d08e7aa6a79b29f7ff9b95f1777a321b99c98ef95e1084d38997e106c04f3975004689a246873

Download Submit
C:\Users\Admin\AppData\Local\Temp\IT6P884R-6NT1-17KU-DG15-V62CV59B\XWorm-RAT-V2.1-builder.exe
Filesize
3.2MB

MD5
6925453f1a0ba21cb5559eb60aa454c2

SHA1
f41d894c216079a1d410747d28a1b2017a7e5601

SHA256
eeaf8ab27825be4133d2bef1fb9db23b23edade4b21c31976aefe66807eac93a

SHA512
aa2a6379b6e7489cdbb10a46af7c362d5e6ab826935807bfa37d08e7aa6a79b29f7ff9b95f1777a321b99c98ef95e1084d38997e106c04f3975004689a246873

Download Submit
memory/4720-136-0x0000000000000000-mapping.dmp

Download
memory/4720-141-0x00007FFFDEB20000-0x00007FFFDF5E1000-memory.dmp

Filesize
10.8MB

Download
memory/4720-142-0x00007FFFDEB20000-0x00007FFFDF5E1000-memory.dmp

Filesize
10.8MB

Download
memory/4988-132-0x00000196BC900000-0x00000196BCC3E000-memory.dmp

Filesize
3.2MB

Download
memory/4988-133-0x00007FFFDEB20000-0x00007FFFDF5E1000-memory.dmp

Filesize
10.8MB

Download
memory/4988-134-0x00000196D7110000-0x00000196D711A000-memory.dmp

Filesize
40KB

Download
memory/4988-135-0x00000196D70B0000-0x00000196D70C2000-memory.dmp

Filesize
72KB

Download
memory/4988-140-0x00007FFFDEB20000-0x00007FFFDF5E1000-memory.dmp

Filesize
10.8MB

Download