General
-
Target
botkiller_v2.exe
-
Size
2.4MB
-
Sample
240212-wwb7nace43
-
MD5
393f1a65423bed5cd9fe07f0961c57fd
-
SHA1
24e44d12f7b480cbde26416ed0c0d5d6de16d173
-
SHA256
f5883a24e7944446c96fd756ff7903fb82d7af8eb3d67d4d45e05a9d6481d78b
-
SHA512
98722a4bfc30ba4ca2804fd18a2bec26c8cf4c55aaae29992067e7e212fb9b3756c3e67ad97623410dff780ae6b5e325427df51d4ccbc3b709c9291fe280dff7
-
SSDEEP
49152:N4G1qYbwVg9/146wPdppKF2gZKudi5HezLE06+3QXYfjbV+e:N5wSh146UBKPPdiBOE0QIfjb1
Static task
static1
Behavioral task
behavioral1
Sample
botkiller_v2.exe
Resource
win11-20231222-en
Malware Config
Extracted
xworm
147.185.221.16:40745
-
Install_directory
%AppData%
-
install_file
Wurst Client.exe
Targets
-
-
Target
botkiller_v2.exe
-
Size
2.4MB
-
MD5
393f1a65423bed5cd9fe07f0961c57fd
-
SHA1
24e44d12f7b480cbde26416ed0c0d5d6de16d173
-
SHA256
f5883a24e7944446c96fd756ff7903fb82d7af8eb3d67d4d45e05a9d6481d78b
-
SHA512
98722a4bfc30ba4ca2804fd18a2bec26c8cf4c55aaae29992067e7e212fb9b3756c3e67ad97623410dff780ae6b5e325427df51d4ccbc3b709c9291fe280dff7
-
SSDEEP
49152:N4G1qYbwVg9/146wPdppKF2gZKudi5HezLE06+3QXYfjbV+e:N5wSh146UBKPPdiBOE0QIfjb1
Score10/10-
Detect Xworm Payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1