xworm | 32ba94d58bb386a630c0f7ff76b730caa6e18dc023262bc160a4bc695d4d6ac2

Analysis

max time kernel
122s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 11:35

Target

msmng2.exe
Size

2.1MB
MD5

3b5757f632446842aac3ecd3f1c28366
SHA1

4e00b5c8670c8a184632bdd48eedb3f90fdd4f19
SHA256

32ba94d58bb386a630c0f7ff76b730caa6e18dc023262bc160a4bc695d4d6ac2
SHA512

bee2b4ea1025ba5fd47ace7b3d9d72527ec6511aeb113f1d709c3df0debcb09405e20c5d746719d2bd91b7f304469c2c7dc9f8b746bec953947bbb9583601c6d
SSDEEP

49152:UqwmCCmvuorNkZQfE8UoGH3pRKl9+VvHu7fAws5Q:b8u8kainHPxVvHW3s5Q

Score

10^/10

Family

xworm

Version

5.0

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000FA0000-0x00000000011C0000-memory.dmp	family_xworm

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000FA0000-0x00000000011C0000-memory.dmp	family_zgrat_v1

Suspicious behavior: EnumeratesProcesses 11 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	msmng2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2644	2264	msmng2.exe	31
PID 2264 wrote to memory of 2644	2264	msmng2.exe	31
PID 2264 wrote to memory of 2644	2264	msmng2.exe	31

C:\Users\Admin\AppData\Local\Temp\msmng2.exe
"C:\Users\Admin\AppData\Local\Temp\msmng2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2264 -s 1552
  2⤵
  PID:2644

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2736

memory/2264-0-0x0000000000FA0000-0x00000000011C0000-memory.dmp

Filesize
2.1MB

Download
memory/2264-1-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

Filesize
9.9MB

Download
memory/2264-2-0x000000001B4C0000-0x000000001B540000-memory.dmp

Filesize
512KB

Download
memory/2264-3-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2264-4-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

Filesize
9.9MB

Download
memory/2264-5-0x000000001B4C0000-0x000000001B540000-memory.dmp

Filesize
512KB

Download