3fb0f72c1a392523344e24575f9cbfd68da6980c93fb883f4fcf5097aa587d78

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm V3.0.exe
Size

12.7MB
MD5

ae32552bced40a6e6a3ac113e2e3c8bd
SHA1

c985dcc696b769a28b5bd755e05a84a34c164e74
SHA256

3fb0f72c1a392523344e24575f9cbfd68da6980c93fb883f4fcf5097aa587d78
SHA512

36d3ba8b7b94b7c86347c890de2c3f88085de72f21bacce44e97c1a8bc145929d7cd25821bf4f973755d8628f0e5eb2885f043dc89a1f3b9a20900546262d356
SSDEEP

393216:IcrS9tCfHAXguucNvPPiaNCh0PDPpGor82MOv1:ZFfglHPZNChcDPpGog/Q

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	XWorm V3.0.exe

Executes dropped EXE 1 IoCs

pid	Process
1108	XWorm V3.1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1108	3592	XWorm V3.0.exe	83
PID 3592 wrote to memory of 1108	3592	XWorm V3.0.exe	83

C:\Users\Admin\AppData\Local\Temp\XWorm V3.0.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm V3.0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe
  "C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe"
  2⤵
  - Executes dropped EXE
  PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe

Filesize
506KB

MD5
2e5e774c1045e4cc0d4f72a06154fcc5

SHA1
5cd65f7b1616a6ce75da9a3527994ba0331fa225

SHA256
cb37eb712f4ecdbb0ebb52c82b307ccafe734d81340e222f2929afb2350de1eb

SHA512
4b23706c2b8fed56940d30425d4437ebc38248c89dca014d1dab78c2adef14ab313d5612fa5564b30575ff65b2aa7853d5ee555084e2a6c33045854847fefea1

Download Submit
C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe

Filesize
7.5MB

MD5
5a68017a9f1898cd403bb0732ff9ea75

SHA1
b9b603b23066eac57f386ba6cbd1e7ae84be879e

SHA256
a8217c425ebe6349db6387ab665f437de2f5e796d069e9daa7dd11fd8a2d707d

SHA512
fea40a84bd58ce6210e8a0dd7db377e22fcf8652b5fa411456d9e7722c9d395437c8aaec25a563b55d85804611ba1c146a3eb4dad2f6356b9509e6b8687787d7

Download Submit
C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe

Filesize
5.6MB

MD5
511232a2c6ef30d4c44fefa0b985afcd

SHA1
08664f5ca9bb1ecfd08a886f39adbdf2e2893020

SHA256
a54e4e6a17baec1d804342d8bba99d227a1558c172399d39c39c35699c17396b

SHA512
10a55e2e8cfacb2e4eeaf461a6464abab35afda5afc5b1653c6b0b8ba09c532f004bac32785ff1ecc179b4dfa763665893d99f0911e06095facbd7102e77d547

Download Submit
memory/1108-14-0x00007FFCCB220000-0x00007FFCCBCE1000-memory.dmp

Filesize
10.8MB

Download
memory/1108-16-0x0000000000EB0000-0x0000000001B4A000-memory.dmp

Filesize
12.6MB

Download
memory/1108-18-0x00007FFCCB220000-0x00007FFCCBCE1000-memory.dmp

Filesize
10.8MB

Download
memory/3592-1-0x0000000000250000-0x0000000000F08000-memory.dmp

Filesize
12.7MB

Download
memory/3592-0-0x00007FFCCB220000-0x00007FFCCBCE1000-memory.dmp

Filesize
10.8MB

Download
memory/3592-15-0x00007FFCCB220000-0x00007FFCCBCE1000-memory.dmp

Filesize
10.8MB

Download