Resubmissions
01-05-2024 04:51
240501-fhbe7sgc8w 101-05-2024 04:43
240501-fch8vsga9z 1001-05-2024 04:43
240501-fcbh1sac65 401-05-2024 04:42
240501-fb44yaga8s 101-05-2024 04:42
240501-fbt9qsac53 401-05-2024 04:41
240501-fbf24sga6x 101-05-2024 04:40
240501-fahjjsga4s 401-05-2024 04:38
240501-e9jp8aga2s 401-05-2024 04:34
240501-e67ymsfh4y 10Analysis
-
max time kernel
12s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2024 04:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-
Resource
win11-20240426-en
General
-
Target
https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133590121269906812" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 3764 chrome.exe 3764 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 3764 chrome.exe 3764 chrome.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe Token: SeShutdownPrivilege 3764 chrome.exe Token: SeCreatePagefilePrivilege 3764 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe 3764 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3764 wrote to memory of 688 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 688 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1672 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1572 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 1572 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe PID 3764 wrote to memory of 3148 3764 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbb5e3cc40,0x7ffbb5e3cc4c,0x7ffbb5e3cc582⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1532 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2156 /prefetch:32⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2428 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3152 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3180 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4584,i,18246956205304995899,13612355009618948819,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4592 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\286b9713-1710-48ef-b811-77e5879a602c.tmpFilesize
77KB
MD54b1e0a0260115cab06374453f5d590db
SHA1ac8eab4319a8342ffc9af6f8215b6c82b232b496
SHA256707c77cea8342891bd6d0cfd3d8901a4aaecbf2ea004a5af5cb28d9a9b9b582e
SHA512d2a84d3a3e392371597a2ad7ad486be8631c50a3b3ed58f8e9bd7a32d118c3483aa0c05ca785e0fc64448dbbefcceae85802bfdeed9bda830eb45a0b9c315daa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsStateFilesize
649B
MD5d5ad50f19b99008b32463b3422921681
SHA1499953bd888b3a9816a84d54ec8732b7b35f5ab6
SHA256948518ad0434968895d41f1a48def307494a6b952950ce3f2b1bb69cb8047750
SHA512135a2aaa954813c6d54ac51b1c739136b0ea842844e59e7993d58762a69b0809397f0b5128eab8c0d23883491fb56780ca5f40cea71cac5980cf11d3c18df13c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD551eacdd0e99031c27885b424303e83e4
SHA18fa1c7a5ec63689729d4488bb91a76effed9499c
SHA25600a309ffea6f532673f8d8a1f4d9ececff271063e973bc74d2f70a0023d5b49b
SHA5125af44948cb3680d6f98ead3687e6a48eacbe95e6db09490f932778a9453bd076f89637746172e25c16b1bca6db7931d5458f6b4d6723de9b90905e102ee0d8cc
-
\??\pipe\crashpad_3764_KLVOCSDURLLVFNHAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e