Analysis
-
max time kernel
28s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
02-03-2023 00:15
General
-
Target
XWorm RAT LATEST/XWorm-RAT-V2.1-builder.exe
-
Size
3.5MB
-
MD5
775ff5af83a841cd38d17f0e89850d31
-
SHA1
977a6139d96c3d0289b3f6ed9ec54ed2ecc0247e
-
SHA256
416d0f5e93bd4249b00d6907264d870401255dba0fa4983017ae6f34af36dc1b
-
SHA512
730628bf0f43c069728938656c939784c6146660668d9d5e91ac473f3aff0096fad0804ee2c88b9571ddba2354761668dc550ef4bae6266922dfae8cfc075349
-
SSDEEP
24576:508GeFzFDzPLDP8c1uAowyLQfB/eVjKIOQaBcM707ae8gpeJF+kR8YD2Y35/5Mbi:Z/TjrHWKWDOQko29ueJsq8z0H
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm RAT LATEST\XWorm-RAT-V2.1-builder.exe"C:\Users\Admin\AppData\Local\Temp\XWorm RAT LATEST\XWorm-RAT-V2.1-builder.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-builder.exe"C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-builder.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1976 -s 14963⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\discord.exe"C:\Users\Admin\AppData\Local\Temp\discord.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-builder.exeFilesize
3.2MB
MD5339b7f92641c0f5161731fc681aaeb3a
SHA121d2d89e9ade90df638f33d314ac68e30f6aa52e
SHA256b6fb77dfd00695678b06ed122523a0b067077fe69113f395661cd3be748d9f7c
SHA51258e5ff1d92be52df114b7f060d700823dff9158ec765cf9b19ab9df0ace2669405467f49d1bd56ce04871683fbcbaace5976ebdbd1575490ff411333a3905134
-
C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-builder.exeFilesize
3.2MB
MD5339b7f92641c0f5161731fc681aaeb3a
SHA121d2d89e9ade90df638f33d314ac68e30f6aa52e
SHA256b6fb77dfd00695678b06ed122523a0b067077fe69113f395661cd3be748d9f7c
SHA51258e5ff1d92be52df114b7f060d700823dff9158ec765cf9b19ab9df0ace2669405467f49d1bd56ce04871683fbcbaace5976ebdbd1575490ff411333a3905134
-
C:\Users\Admin\AppData\Local\Temp\discord.exeFilesize
159KB
MD546a2cc3ad2ade7a6b5551b53636e0abb
SHA1b8eb52479e933c3530ca826fbe59567af3c4f6ec
SHA256f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5
SHA5127649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f
-
C:\Users\Admin\AppData\Local\Temp\discord.exeFilesize
159KB
MD546a2cc3ad2ade7a6b5551b53636e0abb
SHA1b8eb52479e933c3530ca826fbe59567af3c4f6ec
SHA256f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5
SHA5127649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f
-
\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-builder.exeFilesize
3.2MB
MD5339b7f92641c0f5161731fc681aaeb3a
SHA121d2d89e9ade90df638f33d314ac68e30f6aa52e
SHA256b6fb77dfd00695678b06ed122523a0b067077fe69113f395661cd3be748d9f7c
SHA51258e5ff1d92be52df114b7f060d700823dff9158ec765cf9b19ab9df0ace2669405467f49d1bd56ce04871683fbcbaace5976ebdbd1575490ff411333a3905134
-
\Users\Admin\AppData\Local\Temp\discord.exeFilesize
159KB
MD546a2cc3ad2ade7a6b5551b53636e0abb
SHA1b8eb52479e933c3530ca826fbe59567af3c4f6ec
SHA256f8af311b3903b6ccd62cb62fed4903eb4351b4b886df23f815cbb61a8feb68d5
SHA5127649c0eab09b770fd2e3a068fc84fb8d40b56207b1809bc6ba0b93955177535b7c3453c24430dc32327603db3541a4c8eac568bf59b18f28eb8fe3071e70217f
-
memory/308-68-0x00000000012F0000-0x000000000131E000-memory.dmpFilesize
184KB
-
memory/308-71-0x0000000000BD0000-0x0000000000C10000-memory.dmpFilesize
256KB
-
memory/1976-69-0x0000000000C50000-0x0000000000F8E000-memory.dmpFilesize
3.2MB
-
memory/1976-70-0x0000000000250000-0x0000000000270000-memory.dmpFilesize
128KB
-
memory/1976-72-0x000000001B080000-0x000000001B100000-memory.dmpFilesize
512KB
-
memory/1976-73-0x000000001B080000-0x000000001B100000-memory.dmpFilesize
512KB
-
memory/2024-66-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB