Overview
overview
10Static
static
10XWorm v5.1-5.2.7z
windows7-x64
3XWorm v5.1-5.2.7z
windows10-2004-x64
7XWorm/XWor....1.exe
windows7-x64
10XWorm/XWor....1.exe
windows10-2004-x64
10XWorm/XWor...32.exe
windows7-x64
1XWorm/XWor...32.exe
windows10-2004-x64
10XWorm/XWor...64.exe
windows7-x64
1XWorm/XWor...64.exe
windows10-2004-x64
10XWorm/XWor...or.dll
windows7-x64
1XWorm/XWor...or.dll
windows10-2004-x64
1XWorm/XWor...NC.dll
windows7-x64
1XWorm/XWor...NC.dll
windows10-2004-x64
1XWorm/XWor...ry.dll
windows7-x64
1XWorm/XWor...ry.dll
windows10-2004-x64
1XWorm/XWor...ps.dll
windows7-x64
1XWorm/XWor...ps.dll
windows10-2004-x64
1XWorm/XWor...ns.dll
windows7-x64
1XWorm/XWor...ns.dll
windows10-2004-x64
1XWorm/XWor...er.dll
windows7-x64
1XWorm/XWor...er.dll
windows10-2004-x64
1XWorm/XWor...ps.dll
windows7-x64
1XWorm/XWor...ps.dll
windows10-2004-x64
1XWorm/XWor...ox.dll
windows7-x64
1XWorm/XWor...ox.dll
windows10-2004-x64
1XWorm/XWor...ne.dll
windows7-x64
1XWorm/XWor...ne.dll
windows10-2004-x64
1XWorm/XWor...sk.dll
windows7-x64
1XWorm/XWor...sk.dll
windows10-2004-x64
1XWorm/XWor....2.exe
windows7-x64
10XWorm/XWor....2.exe
windows10-2004-x64
10XWorm/XWor...32.exe
windows7-x64
1XWorm/XWor...32.exe
windows10-2004-x64
10Analysis
- max time kernel
162s - max time network
175s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
17/03/2024, 18:51
Behavioral task
behavioral1
Sample
XWorm v5.1-5.2.7z
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
XWorm v5.1-5.2.7z
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
XWorm/XWorm V5.1/XWorm V5.1.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
XWorm/XWorm V5.1/XWorm V5.1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
XWorm/XWorm V5.1/XWormLoader 5.1 x32.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
XWorm/XWorm V5.1/XWormLoader 5.1 x32.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
XWorm/XWorm V5.1/XWormLoader 5.1 x64.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
XWorm/XWorm V5.1/XWormLoader 5.1 x64.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
XWorm/XWorm V5.2/IconExtractor.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
XWorm/XWorm V5.2/IconExtractor.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
XWorm/XWorm V5.2/Plugins/HVNC.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
XWorm/XWorm V5.2/Plugins/HVNC.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
XWorm/XWorm V5.2/Plugins/HVNCMemory.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
XWorm/XWorm V5.2/Plugins/HVNCMemory.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
XWorm/XWorm V5.2/Plugins/HiddenApps.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
XWorm/XWorm V5.2/Plugins/HiddenApps.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
XWorm/XWorm V5.2/Plugins/Informations.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
XWorm/XWorm V5.2/Plugins/Informations.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
XWorm/XWorm V5.2/Plugins/Keylogger.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
XWorm/XWorm V5.2/Plugins/Keylogger.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
XWorm/XWorm V5.2/Plugins/Maps.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral22
Sample
XWorm/XWorm V5.2/Plugins/Maps.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
XWorm/XWorm V5.2/Plugins/MessageBox.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
XWorm/XWorm V5.2/Plugins/MessageBox.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
XWorm/XWorm V5.2/Plugins/Microphone.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
XWorm/XWorm V5.2/Plugins/Microphone.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
XWorm/XWorm V5.2/Plugins/Ngrok-Disk.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
XWorm/XWorm V5.2/Plugins/Ngrok-Disk.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
XWorm/XWorm V5.2/XWorm V5.2.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
XWorm/XWorm V5.2/XWorm V5.2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
XWorm/XWorm V5.2/XWormLoader 5.2 x32.exe
Resource
win7-20231129-en
windows7-x64
General
- Target XWorm/XWorm V5.2/Plugins/HiddenApps.dll
- Size 45KB
- Sample240317-xhqcssdf4w
- SHA256 f9ef7709f34e944d99ca5bef6af1524d7cf3889894084b7ae61e9202f267a728
- MD5 c5efa70a04a026b9a2fa97b1ea43e840
- SHA1 aab2de0ab74c12e04256ff2b113b062dc93179e6
- SHA512 1348d4ebd3ac5b56eb32820ee14f9aee20a43b7dc3d06dd7fd62c8f227b12a27d0c0376c7d858e78315cd92d17e588bc2e37648c04d146530db706e8b3c4ff1d
- SSDEEP 768:zy37gsdDvMZ9+rdm2KExqbMYRQpWk/x0qqBi3X/G0gpfN3ff2oA:idDvML+r/rqbMYRQpl/x5qI/dEdX2J
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm\XWorm V5.2\Plugins\HiddenApps.dll",#11⤵PID:2356
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=748 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:3168