Overview

overview

8

Static

static

3

ComponentF...it.dll

windows10-2004-x64

1

D3DX9_43.dll

windows10-2004-x64

1

Krypton.Toolkit.dll

windows10-2004-x64

1

Mono.Cecil.dll

windows10-2004-x64

1

Mono.Nat.dll

windows10-2004-x64

1

Vestris.Re...ib.dll

windows10-2004-x64

1

xworm.exe

windows10-2004-x64

8

Resubmissions

08/06/2024, 18:14

240608-wvrkysec3z 8

19/05/2024, 22:53

240519-2t2mesfe8t 8

Sharing

Copy URL Twitter E-mail

General

  • Target

    XWorm.rar

  • Size

    3.7MB

  • Sample

    240519-2t2mesfe8t

  • MD5

    44ad26d620213d7768ad9b16f6dbabd1

  • SHA1

    b702f8b33db26a53337d8df94c31eef165e5f959

  • SHA256

    17145113c0f49cb080c2e133584d55fa240e8920c37157757a9e78187e5ae150

  • SHA512

    f75bd6265884dce31fdb7ae600d7d5d6a21ce704ba86945c1e6bbbf5a587ead06740a6dcef6df9b7a54d06201e173d8bb0589402855ebd946e18e69c7c3931ce

  • SSDEEP

    98304:xWjjvhd8cMOBmYS1svAJFFa6XmeuwSqUjGMtokcqFdRaDzmLW/nQDo:xWjjJd8vNYNQFzEvBVtoFqFAean

Score
8/10
execution

Malware Config

Targets

    • Target

      ComponentFactory.Krypton.Toolkit.dll

    • Size

      2.8MB

    • MD5

      129884de0e136521fd650c59b2633e82

    • SHA1

      43fea10a62670568c00a2910c3ee6fc1ceaa1bdc

    • SHA256

      8c69f5df110bc1a61bdc3d8754ebfd3f49d9d995b9dd129accaf88371ce71e30

    • SHA512

      fbd40a8dd172449de46cecc08cdc2078409e5d893426364630c974903499c617f8cca2f4fd52cf030a835a376e140daf113a6d385027a9e2ede289ba32c8da43

    • SSDEEP

      24576:9aA+gKf9mE6kWF2IaltkdgZUfoOJtMl6X1ZTJxf9VqY7djlb1IqdGsUfSYqsyb:UIaltkdgqHJtMl6XD7h7Nh1ImYqsy

    Score
    1/10
    behavioral1

    • Target

      D3DX9_43.dll

    • Size

      2.3MB

    • MD5

      7160fc226391c0b50c85571fa1a546e5

    • SHA1

      2bf450850a522a09e8d1ce0f1e443d86d934f4ad

    • SHA256

      84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4

    • SHA512

      dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b

    • SSDEEP

      49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW

    Score
    1/10
    behavioral2

    • Target

      Krypton.Toolkit.dll

    • Size

      4.3MB

    • MD5

      068b4f05eb35479a419bc55da643781e

    • SHA1

      1d0fe6bb23bbd63dc6d4248f7c17afcf4bc16dea

    • SHA256

      477ebd61ce116c6908a1cd1e50bc93869f6f7b9c3e0e5757551e6dd2a01b4648

    • SHA512

      f9022c7d91364519f5b773fd641741637f89a4f4f8eb1406d1c594e0a286724cea7494fb047e810bbed0579b6870db49a6828b1c79808e4554d762f326a87dcc

    • SSDEEP

      49152:tmB08naO5IDdOBQNJxtk7ryrDdkny3y+sUFdRcRkMb2J:Mu8naO5oj9k7rODdlmHOMbO

    Score
    1/10
    behavioral3

    • Target

      Mono.Cecil.dll

    • Size

      277KB

    • MD5

      8df4d6b5dc1629fcefcdc20210a88eac

    • SHA1

      16c661757ad90eb84228aa3487db11a2eac6fe64

    • SHA256

      3e4288b32006fe8499b43a7f605bb7337931847a0aa79a33217a1d6d1a6c397e

    • SHA512

      874b4987865588efb806a283b0e785fd24e8b1562026edd43050e150bce6c883134f3c8ad0f8c107b0fb1b26fce6ddcc7e344a5f55c3788dac35035b13d15174

    • SSDEEP

      6144:iYOMWAEq+PAEwGQ9Xivs0s4EtS1Fv8jnLKdFvkPo2:AG+PpjQSHv8jA

    Score
    1/10
    behavioral4

    • Target

      Mono.Nat.dll

    • Size

      40KB

    • MD5

      bf929442b12d4b5f9906b29834bf7db1

    • SHA1

      810a2b3c8e548d1df931538bc304cc1405f7a32b

    • SHA256

      b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0

    • SHA512

      9fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828

    • SSDEEP

      768:yoVesKx0V2LpibQJxoKUDHj560aSX3zlJAO:lVespQibC+H56k3fF

    Score
    1/10
    behavioral5

    • Target

      Vestris.ResourceLib.dll

    • Size

      76KB

    • MD5

      64e9cb25aeefeeba3bb579fb1a5559bc

    • SHA1

      e719f80fcbd952609475f3d4a42aa578b2034624

    • SHA256

      34cab594ce9c9af8e12a6923fc16468f5b87e168777db4be2f04db883c1db993

    • SHA512

      b21cd93f010b345b09b771d24b2e5eeed3b73a82fc16badafea7f0324e39477b0d7033623923313d2de5513cb778428ae10161ae7fc0d6b00e446f8d89cf0f8c

    • SSDEEP

      1536:5Z0R489PUoltCY19T7Uf5DYoRvtkA2MNmjYgGKeK9jXGYWs:L0R489PUeCy7Uf5pVCMwjVG/K9jp

    Score
    1/10
    behavioral6

    • Target

      xworm.exe

    • Size

      227KB

    • MD5

      f25ef9e7998ae6d7db70c919b1d9636b

    • SHA1

      572146d53d0d7b3c912bc6a24f458d67b77a53fe

    • SHA256

      7face24db4aa43220ebc4d3afb6c739307f8b653c686b829fb1cb6091695c113

    • SHA512

      d8682cdb5876f9ffe6aa8856d5ffa8c168afd25fc927781d80d129491fa04aabf045f01d13ffb51e3db9773367cc00fce466e1ef7af11bfc3d7af13df06cc17c

    • SSDEEP

      6144:YdAfHWAy5hne6jlVg1jCYRCuAOm6Tw8ym:Yqf7y5he6DkQutw8ym

    Score
    8/10
    execution

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral7

MITRE ATT&CK Enterprise v15

Tasks