Overview
overview
10Static
static
10XWorm-Rat-...in.zip
windows7-x64
1XWorm-Rat-...in.zip
windows10-2004-x64
1XWorm-Rat-...er.exe
windows7-x64
3XWorm-Rat-...er.exe
windows10-2004-x64
1XWorm-Rat-...ox.dll
windows7-x64
1XWorm-Rat-...ox.dll
windows10-2004-x64
1XWorm-Rat-...er.bat
windows7-x64
1XWorm-Rat-...er.bat
windows10-2004-x64
1XWorm-Rat-...IP.dat
windows7-x64
3XWorm-Rat-...IP.dat
windows10-2004-x64
3XWorm-Rat-...I2.dll
windows7-x64
1XWorm-Rat-...I2.dll
windows10-2004-x64
1XWorm-Rat-...io.dll
windows7-x64
1XWorm-Rat-...io.dll
windows10-2004-x64
1XWorm-Rat-...DME.md
windows7-x64
3XWorm-Rat-...DME.md
windows10-2004-x64
3XWorm-Rat-...er.php
windows7-x64
3XWorm-Rat-...er.php
windows10-2004-x64
3XWorm-Rat-...NC.exe
windows7-x64
7XWorm-Rat-...NC.exe
windows10-2004-x64
7XWorm-Rat-...er.exe
windows7-x64
3XWorm-Rat-...er.exe
windows10-2004-x64
3XWorm-Rat-...UI.exe
windows7-x64
10XWorm-Rat-...UI.exe
windows10-2004-x64
10XWorm-Rat-...ib.dll
windows7-x64
1XWorm-Rat-...ib.dll
windows10-2004-x64
1XWorm-Rat-...ib.exe
windows7-x64
3XWorm-Rat-...ib.exe
windows10-2004-x64
10Analysis
-
max time kernel
129s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19-04-2023 14:45
Behavioral task
behavioral1
Sample
XWorm-Rat-Remote-Administration-Tool--main.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
XWorm-Rat-Remote-Administration-Tool--main.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
XWorm-Rat-Remote-Administration-Tool--main/DisAsClaimer.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
XWorm-Rat-Remote-Administration-Tool--main/DisAsClaimer.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
XWorm-Rat-Remote-Administration-Tool--main/FastColoredTextBox.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
XWorm-Rat-Remote-Administration-Tool--main/FastColoredTextBox.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
XWorm-Rat-Remote-Administration-Tool--main/Fixer.bat
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
XWorm-Rat-Remote-Administration-Tool--main/Fixer.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
XWorm-Rat-Remote-Administration-Tool--main/GeoIP.dat
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
XWorm-Rat-Remote-Administration-Tool--main/GeoIP.dat
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
XWorm-Rat-Remote-Administration-Tool--main/Guna.UI2.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
XWorm-Rat-Remote-Administration-Tool--main/Guna.UI2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
XWorm-Rat-Remote-Administration-Tool--main/NAudio.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
XWorm-Rat-Remote-Administration-Tool--main/NAudio.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
XWorm-Rat-Remote-Administration-Tool--main/README.md
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
XWorm-Rat-Remote-Administration-Tool--main/README.md
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
XWorm-Rat-Remote-Administration-Tool--main/Uploader.php
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
XWorm-Rat-Remote-Administration-Tool--main/Uploader.php
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
XWorm-Rat-Remote-Administration-Tool--main/XHVNC.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
XWorm-Rat-Remote-Administration-Tool--main/XHVNC.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
XWorm-Rat-Remote-Administration-Tool--main/XWorm-RAT-V2.1-builder.exe
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
XWorm-Rat-Remote-Administration-Tool--main/XWorm-RAT-V2.1-builder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
XWorm-Rat-Remote-Administration-Tool--main/XWormUI.exe
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
XWorm-Rat-Remote-Administration-Tool--main/XWormUI.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
XWorm-Rat-Remote-Administration-Tool--main/dnlib.dll
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
XWorm-Rat-Remote-Administration-Tool--main/dnlib.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
XWorm-Rat-Remote-Administration-Tool--main/dnlib.exe
Resource
win7-20230220-en
General
-
Target
XWorm-Rat-Remote-Administration-Tool--main/XWormUI.exe
-
Size
49KB
-
MD5
9b64d05f82ebaa3e51a79c1beeed2181
-
SHA1
28b89cd9f181c41586b06f3e3c1f90e2270781ef
-
SHA256
93c7fd938042af85f3d429c387b04952f4b97832857fbf0156ae82e4f516fcf8
-
SHA512
580bc63ec3e6993099deae7e103f8565b42cce3288d78186f9dabea3d8e5c2e6816e1b20439fafd5b94ff24cbaa3eba1154cb995692b3674d5c5c63b6c1dfc13
-
SSDEEP
768:xuQSNTvEEaBrWUXQd5mo2qmiVzKSPCiPIxUjbHgX3iRudoy8FEY+YBDZSxDlD:xuQSNT8542xW6x0bAXSox8deDlD
Malware Config
Extracted
asyncrat
0.5.7B
Default
37.18.62.18:8060
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
ChromeUpdate.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral23/memory/1748-54-0x00000000002A0000-0x00000000002B2000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\ChromeUpdate.exe asyncrat C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe asyncrat C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe asyncrat behavioral23/memory/1820-68-0x0000000000120000-0x0000000000132000-memory.dmp asyncrat behavioral23/memory/1820-69-0x0000000004E80000-0x0000000004EC0000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
ChromeUpdate.exepid process 1820 ChromeUpdate.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 304 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 524 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
XWormUI.exepid process 1748 XWormUI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
XWormUI.exeChromeUpdate.exedescription pid process Token: SeDebugPrivilege 1748 XWormUI.exe Token: SeDebugPrivilege 1820 ChromeUpdate.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
XWormUI.execmd.execmd.exedescription pid process target process PID 1748 wrote to memory of 1496 1748 XWormUI.exe cmd.exe PID 1748 wrote to memory of 1496 1748 XWormUI.exe cmd.exe PID 1748 wrote to memory of 1496 1748 XWormUI.exe cmd.exe PID 1748 wrote to memory of 1496 1748 XWormUI.exe cmd.exe PID 1748 wrote to memory of 304 1748 XWormUI.exe cmd.exe PID 1748 wrote to memory of 304 1748 XWormUI.exe cmd.exe PID 1748 wrote to memory of 304 1748 XWormUI.exe cmd.exe PID 1748 wrote to memory of 304 1748 XWormUI.exe cmd.exe PID 1496 wrote to memory of 764 1496 cmd.exe schtasks.exe PID 1496 wrote to memory of 764 1496 cmd.exe schtasks.exe PID 1496 wrote to memory of 764 1496 cmd.exe schtasks.exe PID 1496 wrote to memory of 764 1496 cmd.exe schtasks.exe PID 304 wrote to memory of 524 304 cmd.exe timeout.exe PID 304 wrote to memory of 524 304 cmd.exe timeout.exe PID 304 wrote to memory of 524 304 cmd.exe timeout.exe PID 304 wrote to memory of 524 304 cmd.exe timeout.exe PID 304 wrote to memory of 1820 304 cmd.exe ChromeUpdate.exe PID 304 wrote to memory of 1820 304 cmd.exe ChromeUpdate.exe PID 304 wrote to memory of 1820 304 cmd.exe ChromeUpdate.exe PID 304 wrote to memory of 1820 304 cmd.exe ChromeUpdate.exe PID 304 wrote to memory of 1820 304 cmd.exe ChromeUpdate.exe PID 304 wrote to memory of 1820 304 cmd.exe ChromeUpdate.exe PID 304 wrote to memory of 1820 304 cmd.exe ChromeUpdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe"C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ChromeUpdate" /tr '"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ChromeUpdate" /tr '"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2924.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"C:\Users\Admin\AppData\Roaming\ChromeUpdate.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2924.tmp.batFilesize
156B
MD5989ed820c656350b217255a0fbfbff2d
SHA132353cba4fa7b192a5413d24bdc0928642497340
SHA256cbead317b735aac31ee742179c95abcede0787de131724351dd45bdbd74d6210
SHA5123c29f9f8268169919c9df03113bd2bd3bb8b9f91eb9d2f350e2a9357b26a31ab1d64c3063b2eb0b42bf0b3d5316d5f582b0a4c400e6f0d714d265b8565a08114
-
C:\Users\Admin\AppData\Local\Temp\tmp2924.tmp.batFilesize
156B
MD5989ed820c656350b217255a0fbfbff2d
SHA132353cba4fa7b192a5413d24bdc0928642497340
SHA256cbead317b735aac31ee742179c95abcede0787de131724351dd45bdbd74d6210
SHA5123c29f9f8268169919c9df03113bd2bd3bb8b9f91eb9d2f350e2a9357b26a31ab1d64c3063b2eb0b42bf0b3d5316d5f582b0a4c400e6f0d714d265b8565a08114
-
C:\Users\Admin\AppData\Roaming\ChromeUpdate.exeFilesize
49KB
MD59b64d05f82ebaa3e51a79c1beeed2181
SHA128b89cd9f181c41586b06f3e3c1f90e2270781ef
SHA25693c7fd938042af85f3d429c387b04952f4b97832857fbf0156ae82e4f516fcf8
SHA512580bc63ec3e6993099deae7e103f8565b42cce3288d78186f9dabea3d8e5c2e6816e1b20439fafd5b94ff24cbaa3eba1154cb995692b3674d5c5c63b6c1dfc13
-
C:\Users\Admin\AppData\Roaming\ChromeUpdate.exeFilesize
49KB
MD59b64d05f82ebaa3e51a79c1beeed2181
SHA128b89cd9f181c41586b06f3e3c1f90e2270781ef
SHA25693c7fd938042af85f3d429c387b04952f4b97832857fbf0156ae82e4f516fcf8
SHA512580bc63ec3e6993099deae7e103f8565b42cce3288d78186f9dabea3d8e5c2e6816e1b20439fafd5b94ff24cbaa3eba1154cb995692b3674d5c5c63b6c1dfc13
-
\Users\Admin\AppData\Roaming\ChromeUpdate.exeFilesize
49KB
MD59b64d05f82ebaa3e51a79c1beeed2181
SHA128b89cd9f181c41586b06f3e3c1f90e2270781ef
SHA25693c7fd938042af85f3d429c387b04952f4b97832857fbf0156ae82e4f516fcf8
SHA512580bc63ec3e6993099deae7e103f8565b42cce3288d78186f9dabea3d8e5c2e6816e1b20439fafd5b94ff24cbaa3eba1154cb995692b3674d5c5c63b6c1dfc13
-
memory/1748-54-0x00000000002A0000-0x00000000002B2000-memory.dmpFilesize
72KB
-
memory/1748-55-0x0000000004E80000-0x0000000004EC0000-memory.dmpFilesize
256KB
-
memory/1820-68-0x0000000000120000-0x0000000000132000-memory.dmpFilesize
72KB
-
memory/1820-69-0x0000000004E80000-0x0000000004EC0000-memory.dmpFilesize
256KB
-
memory/1820-70-0x0000000004E80000-0x0000000004EC0000-memory.dmpFilesize
256KB