Analysis

  • max time kernel
    44s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 17:10

General

  • Target

    XWorm RAT V2.1.exe

  • Size

    2.2MB

  • MD5

    835f081566e31c989b525bccb943569c

  • SHA1

    71d04e0a86ce9585e5b7a058beb0a43cf156a332

  • SHA256

    ea9258e9975b8925a739066221d996aef19b4ef4f4c91524f82e39d403f25579

  • SHA512

    9ec58f8c586ecf78ef8d75debc5dba58544558566423a634724bb5ab192aaf64f9ccbee9a5af48124a3366b2a7d24b4db71bb5743978201b881c08bad8f6fb0c

  • SSDEEP

    49152:LdYJMfC7koydmRzCxWO8e89khof23mKijV6WvFw3BAz2tIm0U:qc3vdUEWFySfdw3rtIm

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XWorm RAT V2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\XWorm RAT V2.1.exe"
    1⤵
      PID:2340
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d29758,0x7fef6d29768,0x7fef6d29778
        2⤵
          PID:2888
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:2
          2⤵
            PID:2640
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:8
            2⤵
              PID:2584
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:8
              2⤵
                PID:2524
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2332 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:1
                2⤵
                  PID:1320
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:1
                  2⤵
                    PID:1272
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1160 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:2
                    2⤵
                      PID:1704
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1348 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:1
                      2⤵
                        PID:536
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
                        2⤵
                          PID:1404
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f557688,0x13f557698,0x13f5576a8
                            3⤵
                              PID:896
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:8
                            2⤵
                              PID:2804
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4040 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:1
                              2⤵
                                PID:2772
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1716 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:1
                                2⤵
                                  PID:2124
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2552 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:1
                                  2⤵
                                    PID:2876
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2532 --field-trial-handle=1304,i,7003280274024337949,15216248918713155089,131072 /prefetch:1
                                    2⤵
                                      PID:808
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:1528

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

                                            Filesize

                                            1KB

                                            MD5

                                            a266bb7dcc38a562631361bbf61dd11b

                                            SHA1

                                            3b1efd3a66ea28b16697394703a72ca340a05bd5

                                            SHA256

                                            df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                                            SHA512

                                            0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                            Filesize

                                            344B

                                            MD5

                                            e925f0242cda48a2f4b49bed7cfd055d

                                            SHA1

                                            43d2d6148f2ce6a688f160bad7e81111f96d28ac

                                            SHA256

                                            54a89984f124f8dd10ee89b242f086288f2aa9744f633e94e369a969af9ae1b6

                                            SHA512

                                            bc86246b9a2a3f0081903e8be0621692830826a27afe36d17d5d89e32783044ade5024c86fbbc811f9ae004c563ff7b6aa112c50f5db8e4e44cc4ed2b4531a1a

                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

                                            Filesize

                                            242B

                                            MD5

                                            f57ecce3223b24526ba83e1a48e9e0b8

                                            SHA1

                                            0338e40d0f5cd763e7c745eaa44b9297e2096681

                                            SHA256

                                            e40f57e2f2f98d8c782b03875ebfd4cac6cca1018ac69ccb0069c511eca0a475

                                            SHA512

                                            6b469778e503348ef4c4af2526094151b5be4a0de959161fe79534d93597537bdc2d44a62505d082e2770bc761e1c6ed456ffa97415ca27fefbf516cccd19a26

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                            Filesize

                                            194KB

                                            MD5

                                            36104d04a9994182ba78be74c7ac3b0e

                                            SHA1

                                            0c049d44cd22468abb1d0711ec844e68297a7b3d

                                            SHA256

                                            ccde155056cdce86d7e51dfd4e8fb603e8d816224b1257adfcf9503139dd28f1

                                            SHA512

                                            8c115e3e5925fb01efd8dda889f4d5e890f6daaf40b10d5b8e3d9b19e15dadcb9dcf344f40c43f59a1f5428b3ee49e24e492cf0cb6826add1c03d21efdec52ba

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            168B

                                            MD5

                                            cf0a596d9240d582ad375d6bd99c1eef

                                            SHA1

                                            aca5c69392dc2d9236dd52196c07b9c7e875e4a8

                                            SHA256

                                            9ae2fc4b92801bda4274362da1e573ef8c18ceb3e64aa5c7e2e62eff25ac7eb2

                                            SHA512

                                            69888c63399432ec7aadfd7825a99219d4975cc784edc3f133350156ba88d3c98f17803f323d2729a80553385da1d97b3e273acaa0bf36c2602825af6d4adb4b

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            168B

                                            MD5

                                            757111c7bdfbe376fc8a59926ddb00af

                                            SHA1

                                            5de1f04d9052a193b5a33dda0f4fab75b1ea3e51

                                            SHA256

                                            256d361c935cff0c52630940533e245efdb8d69578041e77c4360f5f11ef7178

                                            SHA512

                                            534d7d92376d60eb10a12beae4b17b982c4ee4355b96c40fce495b5fe5355bdfd93fcdc66570c183a7a6c6d9422665d32ff2ff74b0da60f68eceeab87504a1dc

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                            Filesize

                                            16B

                                            MD5

                                            aefd77f47fb84fae5ea194496b44c67a

                                            SHA1

                                            dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                            SHA256

                                            4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                            SHA512

                                            b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                            Filesize

                                            264KB

                                            MD5

                                            f50f89a0a91564d0b8a211f8921aa7de

                                            SHA1

                                            112403a17dd69d5b9018b8cede023cb3b54eab7d

                                            SHA256

                                            b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                            SHA512

                                            bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                            Filesize

                                            1012B

                                            MD5

                                            232e48c7501de9e4cf355054d104ecde

                                            SHA1

                                            d1b7f5252fda25cb0f9b79170f45bdecfcbda2e4

                                            SHA256

                                            fedec60d6acc71e3918e24469897658ad8c6f2d86e50dd84178780e5291118b6

                                            SHA512

                                            ac678a52b2e114b428b5a9e4752178634429ca1025fc848a7c6529825d9fbd5658307ab5c98d39b0c94f4cf365c6e98a69da205e24779c23f73aeaccc53fbccc

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                            Filesize

                                            357B

                                            MD5

                                            804e4098c73e7cdb68e07171aa33a703

                                            SHA1

                                            c40d772b3f0256b1026bfcb5284bf1b407da8a8a

                                            SHA256

                                            2d837594193478d96cd20d330dbd7ca2412cf3db81b5d5ff0987bbf1bfac0847

                                            SHA512

                                            ce069d0cb3f3553c96fb8778b1866f4b047a539f214d9d585ba8f14b8f0696ce863d82915af36cddeec792559b1c6bc5002fc94212eda91e660f3084bac565f9

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            5KB

                                            MD5

                                            e2172fe5a485a5f8e04d6085abcfc0b5

                                            SHA1

                                            2a6709b214098de2727662802e1ea7746eee58cd

                                            SHA256

                                            e26738bb982a6e23fab12020875bcc5ad9a683ec2f1645704f5ba894b8d5d37d

                                            SHA512

                                            4cafa08e37be84a728f7ab129f04d39d5aad87394e9fdf4fac96de7c1a9aaf11dccbbbd7813c710f69e046dfff6a22e236a7a51d0c46a0d3a4ad894826c271f5

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            f8445b448c1a1ec31a60da113c0c7fbc

                                            SHA1

                                            2ac950aec9cacd9dee61808d190eb5923eaf41bf

                                            SHA256

                                            5b137e51a6349f5d4daedad8bd3122e9d24259765fbfa2267d92147837c913ee

                                            SHA512

                                            dcf24aaf6bbfb2f932a78c15b094cc64e8d3c55654b8128dfd6e00aa4ab041c3b925acd40a8a591d4bcbd149c476fa996bc5173d803593d735838e4a65f50022

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            5KB

                                            MD5

                                            1d4bd7803bd225fa5e1ee8e261295434

                                            SHA1

                                            6bfda3b7e20c142fd279277a9f94755dec02280d

                                            SHA256

                                            a194d511d749db204c1ead9891c3e0a8e28e0988dfd2ab4f2a00ba6866ea8e63

                                            SHA512

                                            709007be85ace8fba2ebaf0e184936726b870fc402955c7e74cd35cb53b8b8a880d6a87ef10bafedf4a4761b1f512c1dd662dd6f5c35b999dd011258f8cf84f0

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            18e723571b00fb1694a3bad6c78e4054

                                            SHA1

                                            afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                            SHA256

                                            8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                            SHA512

                                            43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                          • C:\Users\Admin\AppData\Local\Temp\Cab1F34.tmp

                                            Filesize

                                            65KB

                                            MD5

                                            ac05d27423a85adc1622c714f2cb6184

                                            SHA1

                                            b0fe2b1abddb97837ea0195be70ab2ff14d43198

                                            SHA256

                                            c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                                            SHA512

                                            6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                                          • C:\Users\Admin\AppData\Local\Temp\Tar3529.tmp

                                            Filesize

                                            171KB

                                            MD5

                                            9c0c641c06238516f27941aa1166d427

                                            SHA1

                                            64cd549fb8cf014fcd9312aa7a5b023847b6c977

                                            SHA256

                                            4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                                            SHA512

                                            936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                                          • memory/2340-1-0x0000000074740000-0x0000000074E2E000-memory.dmp

                                            Filesize

                                            6.9MB

                                          • memory/2340-2-0x0000000074740000-0x0000000074E2E000-memory.dmp

                                            Filesize

                                            6.9MB

                                          • memory/2340-0-0x00000000010A0000-0x00000000012E2000-memory.dmp

                                            Filesize

                                            2.3MB