Overview

overview

10

Static

static

7

CG_Loader.exe

windows7-x64

8

CG_Loader.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CG_Loader.exe

  • Size

    25.7MB

  • Sample

    230320-1gmr3ahd9v

  • MD5

    eacee266b414d217ca8869fa8eec977f

  • SHA1

    4368546288967ce75133dad6514ee36713b50b29

  • SHA256

    71ffa8cbd2909f9ca192c76fbea4a473ecbdf7314e21c9953cc27710765000f5

  • SHA512

    9e39ecbc28492baf9294d4c6d7f1f8d9ffd04418754b0e599d42bd241d61e367e0f6e762f3b5fc607894e5e98e3a69939dd4fc3a8dcab0679915f93d82b1d09d

  • SSDEEP

    393216:9eWP83C/eKN0l8btLZbpjw3srjhJ7FpRr/OB1UUWwcfwo2/S3TUFR5:9eT3eelexrdJBpQnUUewjcTUl

Score
10/10
xwormevasionpersistencerattrojanupxvmprotect

Malware Config

Targets

    • Target

      CG_Loader.exe

    • Size

      25.7MB

    • MD5

      eacee266b414d217ca8869fa8eec977f

    • SHA1

      4368546288967ce75133dad6514ee36713b50b29

    • SHA256

      71ffa8cbd2909f9ca192c76fbea4a473ecbdf7314e21c9953cc27710765000f5

    • SHA512

      9e39ecbc28492baf9294d4c6d7f1f8d9ffd04418754b0e599d42bd241d61e367e0f6e762f3b5fc607894e5e98e3a69939dd4fc3a8dcab0679915f93d82b1d09d

    • SSDEEP

      393216:9eWP83C/eKN0l8btLZbpjw3srjhJ7FpRr/OB1UUWwcfwo2/S3TUFR5:9eT3eelexrdJBpQnUUewjcTUl

    Score
    10/10
    evasionpersistenceupxvmprotectxwormrattrojan

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

New Service

1
T1050

Registry Run Keys / Startup Folder

1
T1060

Modify Existing Service

1
T1031

Hidden Files and Directories

1
T1158

Privilege Escalation

New Service

1
T1050

Defense Evasion

Modify Registry

3
T1112

Impair Defenses

1
T1562

Install Root Certificate

1
T1130

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Service Stop

1
T1489

Tasks