Malware Analysis Report

2024-11-30 18:50

Sample ID 240314-w3m8habd8t
Target XWorm-RAT-V2.1-main.zip
SHA256 e9013afbdb2687701cee1fa6f34bf74f8e984adf4b511a07b6ba8dc84d65d086
Tags
xworm ransomware rat trojan agilenet
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e9013afbdb2687701cee1fa6f34bf74f8e984adf4b511a07b6ba8dc84d65d086

Threat Level: Known bad

The file XWorm-RAT-V2.1-main.zip was found to be: Known bad.

Malicious Activity Summary

xworm ransomware rat trojan agilenet

Xworm

Detect Xworm Payload

Contains code to disable Windows Defender

Nirsoft

Obfuscated with Agile.Net obfuscator

Uses the VBS compiler for execution

Executes dropped EXE

Drops file in System32 directory

Sets desktop wallpaper using registry

Enumerates physical storage devices

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-14 18:27

Signatures

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

110s

Max time network

160s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Chromium.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Chromium.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

90s

Max time network

95s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Cmstp-Bypass.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Cmstp-Bypass.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

144s

Max time network

154s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\DicordTokens.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\DicordTokens.dll",#1

Network

Country Destination Domain Proto
US 52.111.227.11:443 tcp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

147s

Max time network

161s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Encoder.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Encoder.dll",#1

Network

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

90s

Max time network

99s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Guna.UI2.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Guna.UI2.dll",#1

Network

Country Destination Domain Proto
NL 52.111.243.30:443 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:31

Platform

win11-20240221-en

Max time kernel

124s

Max time network

161s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\HRDP.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\HRDP.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:31

Platform

win11-20240221-en

Max time kernel

127s

Max time network

161s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Bookmarks.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Bookmarks.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 53.179.17.96.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 74.179.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:31

Platform

win11-20240221-en

Max time kernel

148s

Max time network

174s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\FileSeacher.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\FileSeacher.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:31

Platform

win11-20240221-en

Max time kernel

150s

Max time network

168s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\FileZilla.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\FileZilla.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.246.116.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

149s

Max time network

154s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Info.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Info.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 192.229.221.95:80 tcp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240214-en

Max time kernel

85s

Max time network

94s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main.zip

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 52.111.227.13:443 tcp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

144s

Max time network

152s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Fixer.bat"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\perfc009.dat C:\Windows\system32\lodctr.exe N/A
File created C:\Windows\system32\perfh009.dat C:\Windows\system32\lodctr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3660 wrote to memory of 756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\lodctr.exe
PID 3660 wrote to memory of 756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\lodctr.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Fixer.bat"

C:\Windows\system32\lodctr.exe

lodctr /r

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\Windows\System32\perfh009.dat

MD5 50362589add3f92e63c918a06d664416
SHA1 e1f96e10fb0f9d3bec9ea89f07f97811ccc78182
SHA256 9a60acb9d0cb67b40154feb3ff45119f122301ee059798c87a02cc0c23e2ffce
SHA512 e21404bc7a5708ab1f4bd1df5baff4302bc31ac894d0940a38b8967b40aac46c2b3e51566d6410e66c4e867e1d8a88489adccf8bdcaec682e9ddabc0dac64468

C:\Windows\System32\perfc009.dat

MD5 7f41bddfccdfe4a298b0bfcf14a20836
SHA1 8acacdd3503c65fb2ddc4fbb9f41811ae8550276
SHA256 446d064235ee69494d5797e01e4039eca0a026c9b801cacf0670334104eedbbb
SHA512 bb984e7660899c293eb3e8c14156cee5237e0cd2b0ada7b03c850f027a08d728fe8774f7a377e911ed54bd788ac5c88fd6e24b41fda6d5020dc6fae0e4980c85

Analysis: behavioral11

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240214-en

Max time kernel

149s

Max time network

155s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\BlankScreen.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\BlankScreen.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:31

Platform

win11-20240221-en

Max time kernel

188s

Max time network

190s

Command Line

"C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\XWorm.exe N/A

Uses the VBS compiler for execution

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ENC.img" C:\Users\Admin\Desktop\XWorm.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \Registry\User\S-1-5-21-4280069375-290121026-380765049-1000_Classes\NotificationData C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000001eb78b63c764da01d8a07b65c764da0157fb7f86c764da0114000000 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\Desktop\XWorm.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1268 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1268 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1268 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2832 wrote to memory of 4136 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2832 wrote to memory of 4136 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2832 wrote to memory of 4136 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 3628 wrote to memory of 984 N/A C:\Users\Admin\Desktop\XWorm.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3628 wrote to memory of 984 N/A C:\Users\Admin\Desktop\XWorm.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 2884 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 2884 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 4648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe

"C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lnlb4lc5\lnlb4lc5.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2215.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4727ECD3496F45EC9B555097A2782A73.TMP"

C:\Users\Admin\Desktop\XWorm.exe

"C:\Users\Admin\Desktop\XWorm.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd555d3cb8,0x7ffd555d3cc8,0x7ffd555d3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,4759566441627796660,15836583035413901556,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,4759566441627796660,15836583035413901556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,4759566441627796660,15836583035413901556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,4759566441627796660,15836583035413901556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,4759566441627796660,15836583035413901556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,4759566441627796660,15836583035413901556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,4759566441627796660,15836583035413901556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,4759566441627796660,15836583035413901556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1760 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,4759566441627796660,15836583035413901556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 127.0.0.1:7000 tcp
US 8.8.8.8:53 54.179.17.96.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
N/A 192.168.1.1:80 tcp
N/A 192.168.1.1:80 tcp
N/A 192.168.1.1:80 tcp
N/A 192.168.1.1:80 tcp

Files

memory/1268-0-0x0000000074B60000-0x0000000075311000-memory.dmp

memory/1268-1-0x0000000000020000-0x00000000006B2000-memory.dmp

memory/1268-2-0x0000000005120000-0x00000000051BC000-memory.dmp

memory/1268-3-0x0000000005770000-0x0000000005D16000-memory.dmp

memory/1268-4-0x0000000005260000-0x00000000052F2000-memory.dmp

memory/1268-5-0x00000000054B0000-0x00000000054C0000-memory.dmp

memory/1268-6-0x0000000005200000-0x000000000520A000-memory.dmp

memory/1268-7-0x0000000005360000-0x00000000053B6000-memory.dmp

memory/1268-8-0x00000000054B0000-0x00000000054C0000-memory.dmp

memory/1268-9-0x0000000006590000-0x00000000065F6000-memory.dmp

memory/1268-10-0x0000000074B60000-0x0000000075311000-memory.dmp

memory/1268-11-0x00000000054B0000-0x00000000054C0000-memory.dmp

memory/1268-12-0x00000000054B0000-0x00000000054C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lnlb4lc5\lnlb4lc5.cmdline

MD5 35666b11eff352e9f98f26138e6041c7
SHA1 a7ee1e3613b79c7b1ea15d99e720fc136eda3820
SHA256 94b72961af0b706c0424362f67e4f0588be63134c9a4b646c5b09577846cb898
SHA512 b249a6134ccfa7b2c1acb5e2deeaf45ee10c20903c6aafd4d1332b00e8d962b45a3381e1d838edb4fb4b2b663123bc4488d4f4c72e1e3d306e04bdfd1bc68f22

C:\Users\Admin\AppData\Local\Temp\lnlb4lc5\lnlb4lc5.0.vb

MD5 f191ac5d249d25e7f0d586bdd9efc68e
SHA1 502e7a8dc08fed499c2f27824a0fc2192394c973
SHA256 814007dac90a3c013c39ef42f3dd29324f264f5501bcdf0f9c909e43acc6f98c
SHA512 92e61bce781b30e2719b0d0102099e1b605980edff2e6b2421343c08ce7beef67b28bd7c4efa5fc2c024d828f71b3ccf32f2d821e190440f33f3532600b7ca8c

C:\Users\Admin\AppData\Local\Temp\vbc4727ECD3496F45EC9B555097A2782A73.TMP

MD5 b70192bdfa82953d23893557b94122f2
SHA1 4fd73efd6a6b28f57df1dde6a4241526c5b0fb60
SHA256 6443d3bc34cc48e858c4fdb3ab0ad9a433705f266cb70f92886e90cbf589eab4
SHA512 6dcb0273ffe6675af850d0a5e1976d9e8f8e9d6306a21856b1df4d8c0fef38fb8ff28f113e8c8b923c6451e32e734c514a15f79efe6316f180874f78608928da

C:\Users\Admin\AppData\Local\Temp\RES2215.tmp

MD5 818466c1c38837607d011db7e788b0fc
SHA1 5c18774e998e5a63af055ec7943ab4665be72241
SHA256 f56bf53f5069e5c72315b9956663316b2e6cc022b606f58f10a194d9a62290e0
SHA512 7910bfaa9c4182210569a3d59a2a688d91352b1cb874cab3ae69138442c1ea61d4ad57e3bf9b1f432856541bed521e242320bbbfcf3eaba7ff30d21a30dcbf0d

C:\Users\Admin\Desktop\XWorm.exe

MD5 24ea43180586bfd4e72f850b77f11856
SHA1 5a3e6a614398a68f7e69cf3a4580722ac9c47745
SHA256 0a70ea9ebd65b04c200f3bc44321402acfc7eb715c9f3424b3f73bad1684acdf
SHA512 3ebfb8b382edfb3173e8ba0c28369cedb1c7a9591ea3c32cffd0cc307b9d1276c16e569ee2393690f1a40d1a20b4a97dc099b3e20737d7d3e40f24b0d5f0ba85

memory/3628-30-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

memory/3628-31-0x00007FFD5A400000-0x00007FFD5AEC2000-memory.dmp

memory/3628-32-0x000000001BD30000-0x000000001BD40000-memory.dmp

memory/1268-34-0x0000000011C20000-0x0000000011CA2000-memory.dmp

memory/1268-33-0x00000000054B0000-0x00000000054C0000-memory.dmp

memory/3628-35-0x00000000031C0000-0x00000000031C8000-memory.dmp

memory/3628-36-0x00007FFD5A400000-0x00007FFD5AEC2000-memory.dmp

memory/3628-37-0x000000001BD30000-0x000000001BD40000-memory.dmp

memory/1268-38-0x00000000054B0000-0x00000000054C0000-memory.dmp

memory/3628-39-0x00000000016F0000-0x00000000016FC000-memory.dmp

C:\Users\Admin\NTUSER.DAT{2fa72cf3-34ca-11ed-acae-cbf1edc82a99}.TMContainer00000000000000000001.regtrans-ms.ENC

MD5 7df9136738951b8e4081525b5937464f
SHA1 858d0aa76318bdbc79fde53d5f73cec12bf6c9a1
SHA256 5c0b101eb465abdcb630f6ea9ff8cba43d6017521060c1e274329368beaf3655
SHA512 d0495f1ad4df436c66c64b66e188995fd919c0da9284d729942fd7626483992f69dd2c9cd58b11c6d8616f0a23b34653c62b5bb46f2afa05129667bdac4cabec

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ded21ddc295846e2b00e1fd766c807db
SHA1 497eb7c9c09cb2a247b4a3663ce808869872b410
SHA256 26025f86effef56caa2ee50a64e219c762944b1e50e465be3a6b454bc0ed7305
SHA512 ddfaa73032590de904bba398331fdbf188741d96a17116ada50298b42d6eb7b20d6e50b0cfae8b17e2f145997b8ebce6c8196e6f46fbe11f133d3d82ce3656db

\??\pipe\LOCAL\crashpad_984_DRQGXJKLBSTKOHTS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a0407c5de270b9ae0ceee6cb9b61bbf1
SHA1 fb2bb8184c1b8e680bf873e5537e1260f057751e
SHA256 a56989933628f6a677ad09f634fc9b7dd9cf7d06c72a76ddbb8221bc4a62ffcd
SHA512 65162bf07705dfdd348d4eaf0a3feba08dc2c0942a3a052b4492d0675ab803b104c03c945f5608fac9544681e0fe8b81d1aaca859663e79aa87fcb591ddb8136

C:\Users\Admin\Desktop\How To Decrypt My Files.html

MD5 553cf6c7e10d1c701098d7e1d0a01839
SHA1 3cbdf41c6d02de51754a2696a382485be5175771
SHA256 bfbb59fa451071b37088b6286c3e5941f2536c4d9a1b77c1c6e987da9545b6ae
SHA512 591ace58027c743e663598f29857e3fa52e47e5a015dfb5e46570fcc563b623306b6e9de5df0aed2f5242c7ae88178aced6c909ec3b8c075b5d7239922d3183c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9b5eaa4afadf568d9a3347d382bfb08f
SHA1 0dc286c98e96b24f7cba5f8f9dca4ae53d83ba41
SHA256 fde102c2bd165183c1cd0269890e9243adc0a446c29cf93bb2bd0122f5583422
SHA512 e4975f5a2ceecfa7c789e339ea2c92c76a8f887b83ea299ac89fcf03f28eba17aa1d220de33babf287c6cb5f01f6ffa60b95a97a6ebd5b6604a79197dc360d3a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0d90d2dce0c93853b67ddc7cf6b1e586
SHA1 a8a08f5ad4f38654755b62658aae77d3429918f7
SHA256 854be1ec7e435b7e336e63cd0def596b979c8fbb146d064e611d33668c316f64
SHA512 65fdc648aa2ed501be901f06399a94abb2c5c27193dc52d1510e78e61d61af653a3dcbca50b46c3535907092905e2ada0de7d1258ece9e4f3e8e0d22e343506a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5083103c8c9afa2875aa4433fb7edc77
SHA1 090b983b14975a129b3139ef2a96d2f509739a72
SHA256 11a3457e53031b7b8eb2c89f6c2d0a9787130366ef8c1468bd03d61b84206f7a
SHA512 843afc6c63328041ce9ef156d16cd4fd0e01e862891936a3756eddfda5a76e33a90eb17dd78982b222f9a4547f8bd97b753c85cb4fbc3286b0b4388d7295784c

memory/3628-287-0x000000001BCE0000-0x000000001BCE8000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

91s

Max time network

100s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\FastColoredTextBox.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\FastColoredTextBox.dll",#1

Network

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

101s

Max time network

142s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\ACTWindows.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\ACTWindows.dll",#1

Network

Country Destination Domain Proto
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

133s

Max time network

128s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Chat.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Chat.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

149s

Max time network

165s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Email.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Email.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

147s

Max time network

159s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\HVNC.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\HVNC.dll",#1

Network

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:31

Platform

win11-20240221-en

Max time kernel

148s

Max time network

163s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Bot.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Bot.dll",#1

Network

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

148s

Max time network

157s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Clipboard.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Clipboard.dll",#1

Network

Country Destination Domain Proto
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240214-en

Max time kernel

86s

Max time network

94s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Computerdefaults.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Computerdefaults.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

92s

Max time network

96s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Tools\Background.png"

Signatures

Enumerates physical storage devices

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Tools\Background.png"

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240214-en

Max time kernel

148s

Max time network

154s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Uploader.php"

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2567984660-2719943099-2683635618-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2567984660-2719943099-2683635618-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Uploader.php"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

90s

Max time network

98s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\NAudio.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\NAudio.dll",#1

Network

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

90s

Max time network

94s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\DeletePoints.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\DeletePoints.dll",#1

Network

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

89s

Max time network

99s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\DeleteWD.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\DeleteWD.dll",#1

Network

Country Destination Domain Proto
US 52.111.229.43:443 tcp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

32s

Max time network

142s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\DisableWD.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\DisableWD.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

146s

Max time network

151s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\7zip.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\7zip.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

85s

Max time network

98s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\AskUAC.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\AskUAC.dll",#1

Network

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:30

Platform

win11-20240221-en

Max time kernel

88s

Max time network

95s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\BSOD.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\BSOD.dll",#1

Network

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-03-14 18:26

Reported

2024-03-14 18:31

Platform

win11-20240221-en

Max time kernel

128s

Max time network

158s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Clipper.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Plugins\Clipper.dll",#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

N/A