Overview
overview
10Static
static
10XWorm RAT ...er.exe
windows7-x64
1XWorm RAT ...er.exe
windows10-2004-x64
1XWorm RAT ...er.exe
windows7-x64
1XWorm RAT ...er.exe
windows10-2004-x64
1XWorm RAT ...er.exe
windows7-x64
1XWorm RAT ...er.exe
windows10-2004-x64
1XWorm RAT ...NC.exe
windows7-x64
7XWorm RAT ...NC.exe
windows10-2004-x64
7XWorm RAT ...er.exe
windows7-x64
7XWorm RAT ...er.exe
windows10-2004-x64
7Analysis
-
max time kernel
28s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-03-2023 00:15
Behavioral task
behavioral1
Sample
XWorm RAT LATEST/Tools/HVNC-Server.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
XWorm RAT LATEST/Tools/HVNC-Server.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
XWorm RAT LATEST/Tools/ResHacker.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
XWorm RAT LATEST/Tools/ResHacker.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
XWorm RAT LATEST/Tools/vncviewer.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
XWorm RAT LATEST/Tools/vncviewer.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
XWorm RAT LATEST/XHVNC.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
XWorm RAT LATEST/XHVNC.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
XWorm RAT LATEST/XWorm-RAT-V2.1-builder.exe
Resource
win7-20230220-en
General
-
Target
XWorm RAT LATEST/XHVNC.exe
-
Size
2.2MB
-
MD5
ef691f617d75f45d10af9405de47e253
-
SHA1
9be134d2c7549adf7c6678bb4c43b9f65c83214f
-
SHA256
eaead00ba98021393e7920a2f2f20e70724f716eed0933d50577786ae0289182
-
SHA512
cfe942f09cc75f44aea2eaef80e4dc6a0ebbba020b0c1cefb7efe8e158a6399fb1f5e41d696b932fac542e39ea7b5872fb1adb7c0753670a57fc0f888ee16c61
-
SSDEEP
24576:qmErCsazef+APWb6+CILRbTcJiWevOIWr9Lrdl5p0WdaMCtGjC+UbuzoVGBI:qPF+CWb6+CILRncZe65rb5p0ehVCrvT
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
XHVNC.exediscord.exepid process 792 XHVNC.exe 1900 discord.exe -
Loads dropped DLL 7 IoCs
Processes:
XHVNC.exeWerFault.exepid process 1108 XHVNC.exe 1108 XHVNC.exe 616 WerFault.exe 616 WerFault.exe 616 WerFault.exe 616 WerFault.exe 616 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 616 792 WerFault.exe XHVNC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
discord.exepid process 1900 discord.exe 1900 discord.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
discord.exedescription pid process Token: SeDebugPrivilege 1900 discord.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
XHVNC.exeXHVNC.exedescription pid process target process PID 1108 wrote to memory of 792 1108 XHVNC.exe XHVNC.exe PID 1108 wrote to memory of 792 1108 XHVNC.exe XHVNC.exe PID 1108 wrote to memory of 792 1108 XHVNC.exe XHVNC.exe PID 1108 wrote to memory of 792 1108 XHVNC.exe XHVNC.exe PID 1108 wrote to memory of 1900 1108 XHVNC.exe discord.exe PID 1108 wrote to memory of 1900 1108 XHVNC.exe discord.exe PID 1108 wrote to memory of 1900 1108 XHVNC.exe discord.exe PID 1108 wrote to memory of 1900 1108 XHVNC.exe discord.exe PID 792 wrote to memory of 616 792 XHVNC.exe WerFault.exe PID 792 wrote to memory of 616 792 XHVNC.exe WerFault.exe PID 792 wrote to memory of 616 792 XHVNC.exe WerFault.exe PID 792 wrote to memory of 616 792 XHVNC.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm RAT LATEST\XHVNC.exe"C:\Users\Admin\AppData\Local\Temp\XWorm RAT LATEST\XHVNC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\XHVNC.exe"C:\Users\Admin\AppData\Local\Temp\XHVNC.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 9963⤵
- Loads dropped DLL
- Program crash
PID:616 -
C:\Users\Admin\AppData\Local\Temp\discord.exe"C:\Users\Admin\AppData\Local\Temp\discord.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XHVNC.exeFilesize
1.9MB
MD54904329d091687c9deb08d9bd7282e77
SHA1bcf7fcebb52cad605cb4de65bdd077e600475cc7
SHA256e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
SHA512b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb
-
C:\Users\Admin\AppData\Local\Temp\XHVNC.exeFilesize
1.9MB
MD54904329d091687c9deb08d9bd7282e77
SHA1bcf7fcebb52cad605cb4de65bdd077e600475cc7
SHA256e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
SHA512b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb
-
C:\Users\Admin\AppData\Local\Temp\discord.exeFilesize
159KB
MD546a2cc3ad2ade7a6b5551b53636e0abb
SHA1b8eb52479e933c3530ca826fbe59567af3c4f6ec
SHA256f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5
SHA5127649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f
-
C:\Users\Admin\AppData\Local\Temp\discord.exeFilesize
159KB
MD546a2cc3ad2ade7a6b5551b53636e0abb
SHA1b8eb52479e933c3530ca826fbe59567af3c4f6ec
SHA256f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5
SHA5127649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f
-
\Users\Admin\AppData\Local\Temp\XHVNC.exeFilesize
1.9MB
MD54904329d091687c9deb08d9bd7282e77
SHA1bcf7fcebb52cad605cb4de65bdd077e600475cc7
SHA256e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
SHA512b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb
-
\Users\Admin\AppData\Local\Temp\XHVNC.exeFilesize
1.9MB
MD54904329d091687c9deb08d9bd7282e77
SHA1bcf7fcebb52cad605cb4de65bdd077e600475cc7
SHA256e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
SHA512b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb
-
\Users\Admin\AppData\Local\Temp\XHVNC.exeFilesize
1.9MB
MD54904329d091687c9deb08d9bd7282e77
SHA1bcf7fcebb52cad605cb4de65bdd077e600475cc7
SHA256e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
SHA512b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb
-
\Users\Admin\AppData\Local\Temp\XHVNC.exeFilesize
1.9MB
MD54904329d091687c9deb08d9bd7282e77
SHA1bcf7fcebb52cad605cb4de65bdd077e600475cc7
SHA256e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
SHA512b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb
-
\Users\Admin\AppData\Local\Temp\XHVNC.exeFilesize
1.9MB
MD54904329d091687c9deb08d9bd7282e77
SHA1bcf7fcebb52cad605cb4de65bdd077e600475cc7
SHA256e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
SHA512b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb
-
\Users\Admin\AppData\Local\Temp\XHVNC.exeFilesize
1.9MB
MD54904329d091687c9deb08d9bd7282e77
SHA1bcf7fcebb52cad605cb4de65bdd077e600475cc7
SHA256e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
SHA512b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb
-
\Users\Admin\AppData\Local\Temp\discord.exeFilesize
159KB
MD546a2cc3ad2ade7a6b5551b53636e0abb
SHA1b8eb52479e933c3530ca826fbe59567af3c4f6ec
SHA256f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5
SHA5127649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f
-
memory/792-70-0x0000000000270000-0x000000000045A000-memory.dmpFilesize
1.9MB
-
memory/792-76-0x00000000055D0000-0x0000000005610000-memory.dmpFilesize
256KB
-
memory/792-78-0x00000000055D0000-0x0000000005610000-memory.dmpFilesize
256KB
-
memory/1108-67-0x0000000000400000-0x000000000062F000-memory.dmpFilesize
2.2MB
-
memory/1900-71-0x00000000047F0000-0x0000000004830000-memory.dmpFilesize
256KB
-
memory/1900-69-0x00000000011A0000-0x00000000011CE000-memory.dmpFilesize
184KB