Overview

overview

10

Static

static

10

StandLaunchpad.exe

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    StandLaunchpad.exe

  • Size

    105KB

  • Sample

    240410-x14cdahc23

  • MD5

    95f12a4177a59c964304fed03c5dfaf5

  • SHA1

    3967a256cdc8679add5a1274ae1293ea84e3212d

  • SHA256

    a3dbb910d2887dabbf4180beca4d2ef643c65912f42bc727ff14cad49c89bab7

  • SHA512

    8e3ec70d8c85a33426910fac977f52a81d62f48c5b1238f4d8b4e1f7cccdeb0faec14b2a033dd4ce7cc10fb4c1b2787d733755f0b343311411892a328134ff4a

  • SSDEEP

    1536:dYhQtx5Plne9fAtZbaFTXKiSbqIKsfEP6vMHMOOGYfnq91d8ZL:dRPtlne6ZeFT67b1CWMHMO3RmL

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:22671

147.185.221.19:22671
Attributes
  • Install_directory

    %Temp%

  • install_file

    Stand.exe

  • telegram

    https://api.telegram.org/bot6916721041:AAGsGXyaplDWQ9HJlE88Z36KtBFClSB3E20/sendMessage?chat_id=6061507362

Targets

    • Target

      StandLaunchpad.exe

    • Size

      105KB

    • MD5

      95f12a4177a59c964304fed03c5dfaf5

    • SHA1

      3967a256cdc8679add5a1274ae1293ea84e3212d

    • SHA256

      a3dbb910d2887dabbf4180beca4d2ef643c65912f42bc727ff14cad49c89bab7

    • SHA512

      8e3ec70d8c85a33426910fac977f52a81d62f48c5b1238f4d8b4e1f7cccdeb0faec14b2a033dd4ce7cc10fb4c1b2787d733755f0b343311411892a328134ff4a

    • SSDEEP

      1536:dYhQtx5Plne9fAtZbaFTXKiSbqIKsfEP6vMHMOOGYfnq91d8ZL:dRPtlne6ZeFT67b1CWMHMO3RmL

    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks