xworm | 2351e582e18b9192f76ef1d887dd377cc2f794c6011ac98eed8d6a049352f864

Analysis

max time kernel
30s
max time network
27s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shadow.exe
Size

40KB
MD5

4afda090eb6b598567ea78e107091de8
SHA1

7552d66d51bc5f1be8a55e80bce3cb5af0460ce0
SHA256

2351e582e18b9192f76ef1d887dd377cc2f794c6011ac98eed8d6a049352f864
SHA512

4ddbb8798171d85654cc6aacabb159290ec4fd8862f67a47df1c620e661c1e7fbe15f2ac75fcb14ad1999750d1624dde7a1569d7a35be5b0f528143f8f3cca03
SSDEEP

768:zfw749swluM7R1Acpo+I2tGcy97KdV2UiPNRSy:zs4iA7R1Atr2yOZgky

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:7000

Mutex

SMSuhNoQkgRxeqPg

Attributes

install_file
USB.exe

aes.plain

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

Processes:

shadow.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shadow.exe	shadow.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shadow.exe	shadow.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

shadow.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\shadow = "C:\\Users\\Admin\\AppData\\Roaming\\shadow.exe"	shadow.exe

C:\Users\Admin\AppData\Local\Temp\shadow.exe
"C:\Users\Admin\AppData\Local\Temp\shadow.exe"
1⤵
- Drops startup file
- Adds Run key to start application
PID:940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-133-0x0000000000EB0000-0x0000000000EC0000-memory.dmp

Filesize
64KB

Download
memory/940-137-0x0000000001700000-0x0000000001710000-memory.dmp

Filesize
64KB

Download
memory/940-138-0x0000000001700000-0x0000000001710000-memory.dmp

Filesize
64KB

Download