Analysis
-
max time kernel
151s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
02-03-2023 00:15
General
-
Target
XWorm RAT LATEST/XWorm-RAT-V2.1-builder.exe
-
Size
3.5MB
-
MD5
775ff5af83a841cd38d17f0e89850d31
-
SHA1
977a6139d96c3d0289b3f6ed9ec54ed2ecc0247e
-
SHA256
416d0f5e93bd4249b00d6907264d870401255dba0fa4983017ae6f34af36dc1b
-
SHA512
730628bf0f43c069728938656c939784c6146660668d9d5e91ac473f3aff0096fad0804ee2c88b9571ddba2354761668dc550ef4bae6266922dfae8cfc075349
-
SSDEEP
24576:508GeFzFDzPLDP8c1uAowyLQfB/eVjKIOQaBcM707ae8gpeJF+kR8YD2Y35/5Mbi:Z/TjrHWKWDOQko29ueJsq8z0H
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm RAT LATEST\XWorm-RAT-V2.1-builder.exe"C:\Users\Admin\AppData\Local\Temp\XWorm RAT LATEST\XWorm-RAT-V2.1-builder.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-builder.exe"C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-builder.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1404 -s 18163⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\discord.exe"C:\Users\Admin\AppData\Local\Temp\discord.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 464 -p 1404 -ip 14041⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5339b7f92641c0f5161731fc681aaeb3a
SHA121d2d89e9ade90df638f33d314ac68e30f6aa52e
SHA256b6fb77dfd00695678b06ed122523a0b067077fe69113f395661cd3be748d9f7c
SHA51258e5ff1d92be52df114b7f060d700823dff9158ec765cf9b19ab9df0ace2669405467f49d1bd56ce04871683fbcbaace5976ebdbd1575490ff411333a3905134
-
Filesize
3.2MB
MD5339b7f92641c0f5161731fc681aaeb3a
SHA121d2d89e9ade90df638f33d314ac68e30f6aa52e
SHA256b6fb77dfd00695678b06ed122523a0b067077fe69113f395661cd3be748d9f7c
SHA51258e5ff1d92be52df114b7f060d700823dff9158ec765cf9b19ab9df0ace2669405467f49d1bd56ce04871683fbcbaace5976ebdbd1575490ff411333a3905134
-
Filesize
3.2MB
MD5339b7f92641c0f5161731fc681aaeb3a
SHA121d2d89e9ade90df638f33d314ac68e30f6aa52e
SHA256b6fb77dfd00695678b06ed122523a0b067077fe69113f395661cd3be748d9f7c
SHA51258e5ff1d92be52df114b7f060d700823dff9158ec765cf9b19ab9df0ace2669405467f49d1bd56ce04871683fbcbaace5976ebdbd1575490ff411333a3905134
-
Filesize
159KB
MD546a2cc3ad2ade7a6b5551b53636e0abb
SHA1b8eb52479e933c3530ca826fbe59567af3c4f6ec
SHA256f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5
SHA5127649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f
-
Filesize
159KB
MD546a2cc3ad2ade7a6b5551b53636e0abb
SHA1b8eb52479e933c3530ca826fbe59567af3c4f6ec
SHA256f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5
SHA5127649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f
-
Filesize
159KB
MD546a2cc3ad2ade7a6b5551b53636e0abb
SHA1b8eb52479e933c3530ca826fbe59567af3c4f6ec
SHA256f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5
SHA5127649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f
-
Filesize
3.5MB
-
Filesize
3.2MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
1.0MB
-
Filesize
408KB
-
Filesize
6.1MB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
184KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
472KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
120KB
-
Filesize
320KB