Resubmissions
01-05-2024 04:51
240501-fhbe7sgc8w 101-05-2024 04:43
240501-fch8vsga9z 1001-05-2024 04:43
240501-fcbh1sac65 401-05-2024 04:42
240501-fb44yaga8s 101-05-2024 04:42
240501-fbt9qsac53 401-05-2024 04:41
240501-fbf24sga6x 101-05-2024 04:40
240501-fahjjsga4s 401-05-2024 04:38
240501-e9jp8aga2s 401-05-2024 04:34
240501-e67ymsfh4y 10Analysis
-
max time kernel
12s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2024 04:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-
Resource
win10v2004-20240419-en
windows10-2004-x64
8 signatures
1800 seconds
Behavioral task
behavioral3
Sample
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-
Resource
win11-20240426-en
windows11-21h2-x64
8 signatures
1800 seconds
General
-
Target
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133590121269906812" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3764 chrome.exe 3764 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3764 chrome.exe 3764 chrome.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3764 wrote to memory of 688 3764 chrome.exe 84 PID 3764 wrote to memory of 688 3764 chrome.exe 84 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1672 3764 chrome.exe 85 PID 3764 wrote to memory of 1572 3764 chrome.exe 86 PID 3764 wrote to memory of 1572 3764 chrome.exe 86 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87 PID 3764 wrote to memory of 3148 3764 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbb5e3cc40,0x7ffbb5e3cc4c,0x7ffbb5e3cc582⤵PID:688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1532 /prefetch:22⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2156 /prefetch:32⤵PID:1572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2428 /prefetch:82⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4584,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4592 /prefetch:82⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:2296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD54b1e0a0260115cab06374453f5d590db
SHA1ac8eab4319a8342ffc9af6f8215b6c82b232b496
SHA256707c77cea8342891bd6d0cfd3d8901a4aaecbf2ea004a5af5cb28d9a9b9b582e
SHA512d2a84d3a3e392371597a2ad7ad486be8631c50a3b3ed58f8e9bd7a32d118c3483aa0c05ca785e0fc64448dbbefcceae85802bfdeed9bda830eb45a0b9c315daa
-
Filesize
649B
MD5d5ad50f19b99008b32463b3422921681
SHA1499953bd888b3a9816a84d54ec8732b7b35f5ab6
SHA256948518ad0434968895d41f1a48def307494a6b952950ce3f2b1bb69cb8047750
SHA512135a2aaa954813c6d54ac51b1c739136b0ea842844e59e7993d58762a69b0809397f0b5128eab8c0d23883491fb56780ca5f40cea71cac5980cf11d3c18df13c
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
8KB
MD551eacdd0e99031c27885b424303e83e4
SHA18fa1c7a5ec63689729d4488bb91a76effed9499c
SHA25600a309ffea6f532673f8d8a1f4d9ececff271063e973bc74d2f70a0023d5b49b
SHA5125af44948cb3680d6f98ead3687e6a48eacbe95e6db09490f932778a9453bd076f89637746172e25c16b1bca6db7931d5458f6b4d6723de9b90905e102ee0d8cc