Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 21:09
Behavioral task
behavioral1
Sample
XWorm V5.2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
XWorm V5.2.exe
Resource
win10v2004-20240426-en
General
-
Target
XWorm V5.2.exe
-
Size
12.2MB
-
MD5
8b7b015c1ea809f5c6ade7269bdc5610
-
SHA1
c67d5d83ca18731d17f79529cfdb3d3dcad36b96
-
SHA256
7fc9c7002b65bc1b33f72e019ed1e82008cc7b8e5b8eaf73fc41a3e6a246980e
-
SHA512
e652913f73326f9d8461ac2a631e1e413719df28c7938b38949c005fda501d9e159554c3e17a0d5826d279bb81efdef394f7fb6ff7289cf296c19e92fd924180
-
SSDEEP
196608:pcWPW6SJ5POYAa23tuQUj7prczC9YNu+/ChWbPP91SDwDrZhd:pce0JtOSSLU3prczy0uqkaIkDtn
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
XWorm V5.2.exepid process 2960 XWorm V5.2.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/2960-1-0x00000000002B0000-0x0000000000EE8000-memory.dmp agile_net -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
XWorm V5.2.exedescription pid process Token: SeDebugPrivilege 2960 XWorm V5.2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
XWorm V5.2.exedescription pid process target process PID 2960 wrote to memory of 1784 2960 XWorm V5.2.exe WerFault.exe PID 2960 wrote to memory of 1784 2960 XWorm V5.2.exe WerFault.exe PID 2960 wrote to memory of 1784 2960 XWorm V5.2.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2960 -s 6642⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\TMzpx\TMzpx.dllFilesize
112KB
MD52f1a50031dcf5c87d92e8b2491fdcea6
SHA171e2aaa2d1bb7dbe32a00e1d01d744830ecce08f
SHA25647578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed
SHA5121c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8
-
memory/2960-0-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmpFilesize
4KB
-
memory/2960-1-0x00000000002B0000-0x0000000000EE8000-memory.dmpFilesize
12.2MB
-
memory/2960-8-0x000007FEF5C70000-0x000007FEF665C000-memory.dmpFilesize
9.9MB
-
memory/2960-9-0x000000001CF70000-0x000000001DB5C000-memory.dmpFilesize
11.9MB
-
memory/2960-10-0x000007FEF5C70000-0x000007FEF665C000-memory.dmpFilesize
9.9MB