Overview
overview
10Static
static
10XWorm V3.1...nd.png
windows7-x64
1XWorm V3.1...nd.png
windows10-2004-x64
3XWorm V3.1...ox.dll
windows7-x64
1XWorm V3.1...ox.dll
windows10-2004-x64
1XWorm V3.1...er.bat
windows7-x64
5XWorm V3.1...er.bat
windows10-2004-x64
1XWorm V3.1...re.dll
windows7-x64
1XWorm V3.1...re.dll
windows10-2004-x64
1XWorm V3.1...ms.dll
windows7-x64
1XWorm V3.1...ms.dll
windows10-2004-x64
1XWorm V3.1...IP.dat
windows7-x64
3XWorm V3.1...IP.dat
windows10-2004-x64
3XWorm V3.1...or.dll
windows7-x64
1XWorm V3.1...or.dll
windows10-2004-x64
1XWorm V3.1...ro.wav
windows7-x64
1XWorm V3.1...ro.wav
windows10-2004-x64
6XWorm V3.1...or.dll
windows7-x64
1XWorm V3.1...or.dll
windows10-2004-x64
1XWorm V3.1...NC.exe
windows7-x64
10XWorm V3.1...NC.exe
windows10-2004-x64
10XWorm V3.1....1.exe
windows7-x64
1XWorm V3.1....1.exe
windows10-2004-x64
1XWorm V3.1...xe.xml
windows7-x64
1XWorm V3.1...xe.xml
windows10-2004-x64
1Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17-02-2023 05:04
Static task
static1
Behavioral task
behavioral1
Sample
XWorm V3.1 - Copy/Background.png
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
XWorm V3.1 - Copy/Background.png
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
XWorm V3.1 - Copy/FastColoredTextBox.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
XWorm V3.1 - Copy/FastColoredTextBox.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
XWorm V3.1 - Copy/Fixer.bat
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
XWorm V3.1 - Copy/Fixer.bat
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
XWorm V3.1 - Copy/GMap.NET.Core.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
XWorm V3.1 - Copy/GMap.NET.Core.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
XWorm V3.1 - Copy/GMap.NET.WindowsForms.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
XWorm V3.1 - Copy/GMap.NET.WindowsForms.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
XWorm V3.1 - Copy/GeoIP.dat
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
XWorm V3.1 - Copy/GeoIP.dat
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
XWorm V3.1 - Copy/IconExtractor.dll
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
XWorm V3.1 - Copy/IconExtractor.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
XWorm V3.1 - Copy/Intro.wav
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
XWorm V3.1 - Copy/Intro.wav
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
XWorm V3.1 - Copy/SimpleObfuscator.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
XWorm V3.1 - Copy/SimpleObfuscator.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
XWorm V3.1 - Copy/XWorm HVNC.exe
Resource
win7-20220901-en
Behavioral task
behavioral20
Sample
XWorm V3.1 - Copy/XWorm HVNC.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
XWorm V3.1 - Copy/XWorm V3.1.exe
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
XWorm V3.1 - Copy/XWorm V3.1.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
XWorm V3.1 - Copy/XWorm V3.1.exe.xml
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
XWorm V3.1 - Copy/XWorm V3.1.exe.xml
Resource
win10v2004-20220812-en
General
-
Target
XWorm V3.1 - Copy/XWorm V3.1.exe
-
Size
6.9MB
-
MD5
37a9fdc56e605d2342da88a6e6182b4b
-
SHA1
20bc3df33bbbb676d2a3c572cff4c1d58c79055d
-
SHA256
422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58
-
SHA512
f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3
-
SSDEEP
196608:rLQ6B/XKUDz9NoUXJzUWi7MYjBVvo5/UV:3FlaU/9NZXJZinjB9oxg
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
XWorm V3.1.exedescription pid Process Token: SeDebugPrivilege 364 XWorm V3.1.exe