xworm | 77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2024, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe
Size 555KB
Sample240208-r2eshseg2x
SHA256 77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30
MD5 52d1c4682c38af8d7f28ad67c7ffdca4
SHA1 95c3945849fd4d140fc64697f8223919fb77b8bc
SHA512 91f7dc3a595f7d796c4528b4de4ba02d996c472e0e5ff9a6c23189dd8eca9a12b43a06770c6570879b8c712278c069f7d3dae24944b8caad35ba65ab2d255ca8
SSDEEP 6144:t4hGM+dC2oTHwtEmTQ6T1XEuU9hrYhGUug/js0WQiA6WBkjxqlPh+ZaUZglJb84i:ygdC2mo0G49yGQ/YrkeCl84b2i0C0em
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

213.152.162.15:3556

Mutex

oiPRtDvO68sWMzNE

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3156-11-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 3156	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe
4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe
Token: SeDebugPrivilege	3156	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 3292	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	92
PID 4040 wrote to memory of 3292	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	92
PID 4040 wrote to memory of 3292	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	92
PID 4040 wrote to memory of 3156	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	93
PID 4040 wrote to memory of 3156	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	93
PID 4040 wrote to memory of 3156	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	93
PID 4040 wrote to memory of 3156	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	93
PID 4040 wrote to memory of 3156	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	93
PID 4040 wrote to memory of 3156	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	93
PID 4040 wrote to memory of 3156	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	93
PID 4040 wrote to memory of 3156	4040	77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe	93

C:\Users\Admin\AppData\Local\Temp\77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe
"C:\Users\Admin\AppData\Local\Temp\77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Users\Admin\AppData\Local\Temp\77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe
  "C:\Users\Admin\AppData\Local\Temp\77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe"
  2⤵
  PID:3292
- C:\Users\Admin\AppData\Local\Temp\77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe
  "C:\Users\Admin\AppData\Local\Temp\77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\77a38968b37bcb562fb8df2e70f08d312cabcaaf5dca09e995ead70240a05a30.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

memory/3156-11-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3156-18-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/3156-17-0x0000000074980000-0x0000000075130000-memory.dmp

Download

memory/3156-16-0x0000000005760000-0x0000000005770000-memory.dmp

Download

memory/3156-14-0x0000000074980000-0x0000000075130000-memory.dmp

Download

memory/4040-4-0x00000000059D0000-0x00000000059E0000-memory.dmp

Download

memory/4040-7-0x0000000007020000-0x0000000007028000-memory.dmp

Download

memory/4040-8-0x0000000007060000-0x000000000706C000-memory.dmp

Download

memory/4040-9-0x0000000007250000-0x0000000007298000-memory.dmp

Download

memory/4040-10-0x00000000098B0000-0x000000000994C000-memory.dmp

Download

memory/4040-6-0x0000000005CB0000-0x0000000005CC8000-memory.dmp

Download

memory/4040-5-0x0000000005AA0000-0x0000000005AAA000-memory.dmp

Download

memory/4040-15-0x0000000074980000-0x0000000075130000-memory.dmp

Download

memory/4040-0-0x0000000000F40000-0x0000000000FD2000-memory.dmp

Download

memory/4040-3-0x00000000059F0000-0x0000000005A82000-memory.dmp

Download

memory/4040-2-0x0000000005F00000-0x00000000064A4000-memory.dmp

Download

memory/4040-1-0x0000000074980000-0x0000000075130000-memory.dmp

Download