Resubmissions

01-12-2022 16:45

221201-t9cz1acb3x 10

11-11-2022 18:32

221111-w6lh3scf3v 8

General

  • Target

    2ae3a0c040d6570d55d82d06f3d31584.exe

  • Size

    41KB

  • Sample

    221201-t9cz1acb3x

  • MD5

    2ae3a0c040d6570d55d82d06f3d31584

  • SHA1

    e69f8b020a5ea66426f00458c535b2f0ce336329

  • SHA256

    20d023d654dba4e16ec122b6339633eea418652a30d599a8c4a9bc3698d26b46

  • SHA512

    d87b5cd1c1e9c5c7c1a188f3abceba227035e1b2a8ceba7861e0d5f415868c21d75db5af9808d396a50c5e13e9a42534bd5630caa6869a3d658a2982db24d48d

  • SSDEEP

    768:eOQvBUsvIsEaxV0h/L9/1rsQhLOSyoZV65:eXlAbCGL9/x1OSZZV65

Malware Config

Extracted

Family

xworm

Attributes
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/2L3vs8UY
aes.plain

Targets

    • Target

      2ae3a0c040d6570d55d82d06f3d31584.exe

    • Size

      41KB

    • MD5

      2ae3a0c040d6570d55d82d06f3d31584

    • SHA1

      e69f8b020a5ea66426f00458c535b2f0ce336329

    • SHA256

      20d023d654dba4e16ec122b6339633eea418652a30d599a8c4a9bc3698d26b46

    • SHA512

      d87b5cd1c1e9c5c7c1a188f3abceba227035e1b2a8ceba7861e0d5f415868c21d75db5af9808d396a50c5e13e9a42534bd5630caa6869a3d658a2982db24d48d

    • SSDEEP

      768:eOQvBUsvIsEaxV0h/L9/1rsQhLOSyoZV65:eXlAbCGL9/x1OSZZV65

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Tasks