Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-04-2024 01:45
Behavioral task
behavioral1
Sample
XWorm V5.4 VIP.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
XWorm V5.4 VIP.exe
Resource
win10v2004-20240226-en
General
-
Target
XWorm V5.4 VIP.exe
-
Size
13.8MB
-
MD5
065a8d7fad2ad13b9f04de982294eb21
-
SHA1
7ecf3a3b1a0fa25f701787d98bd42c6f39c2f8ce
-
SHA256
3b2f28e621af3ea54abf28071e2f36143a30aa87a091f0ee3764c15b2dea4303
-
SHA512
0b828b1e545326258f46b7b0c535bfde1fff5ab4bf43bc729803a96e81f4b29a5d0e5a00e59ae392d517051dba37abd5f3b4dacc348242475cfa9e8cbfa16e34
-
SSDEEP
196608:msZttF81Wco24/vt8Kf67RQCTbJev4Z4t2WL8PSlsZA6G:mEtM1VR4cRZ0QZaL8qlsZVG
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
XWorm V5.4 VIP.exepid process 2236 XWorm V5.4 VIP.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/2236-0-0x0000000000EA0000-0x0000000001C80000-memory.dmp agile_net -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
XWorm V5.4 VIP.exedescription pid process Token: SeDebugPrivilege 2236 XWorm V5.4 VIP.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
XWorm V5.4 VIP.exedescription pid process target process PID 2236 wrote to memory of 2520 2236 XWorm V5.4 VIP.exe WerFault.exe PID 2236 wrote to memory of 2520 2236 XWorm V5.4 VIP.exe WerFault.exe PID 2236 wrote to memory of 2520 2236 XWorm V5.4 VIP.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V5.4 VIP.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.4 VIP.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2236 -s 6642⤵PID:2520
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD52f1a50031dcf5c87d92e8b2491fdcea6
SHA171e2aaa2d1bb7dbe32a00e1d01d744830ecce08f
SHA25647578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed
SHA5121c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8