Overview

overview

10

Static

static

10

2024-05-22...ar.exe

windows7-x64

10

2024-05-22...ar.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-05-22_1e06d1f23f474c5e6ba0f279d3d3dfac_hiddentear

  • Size

    133KB

  • Sample

    240522-bzs95agd3s

  • MD5

    1e06d1f23f474c5e6ba0f279d3d3dfac

  • SHA1

    307c847fafc7453a1050d85b6099b113a2790ef0

  • SHA256

    eb8721bfa1bcacc08b8a8712e6a7fc6d4b69776e8b592abef9539c2fc671df50

  • SHA512

    d1d5302d01fff58479385153160ab271b15f87c87cb5d7ab1df153d818ee9f109fcf8318c7622b068bb4344ab2261aca60c571e2e642d0f84e01bf15ade3c5fb

  • SSDEEP

    3072:J+oM/FJZdq/Fk96ytO/fXM+lmsolAIrRuw+mqv9j1MWLQI:C/FJaNk9Ts8+lDAA

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

103.161.170.251:7000

Mutex

O5WJMXQSSZKD5Ijn

Attributes
  • Install_directory

    %Temp%

  • install_file

    khiet.exe

  • telegram

    https://api.telegram.org/bot6833541180:AAEc_LLwKd7Jex1zaN5vTaLg13uuFjIHQEU/sendMessage?chat_id=5747667034

aes.plain

Targets

    • Target

      2024-05-22_1e06d1f23f474c5e6ba0f279d3d3dfac_hiddentear

    • Size

      133KB

    • MD5

      1e06d1f23f474c5e6ba0f279d3d3dfac

    • SHA1

      307c847fafc7453a1050d85b6099b113a2790ef0

    • SHA256

      eb8721bfa1bcacc08b8a8712e6a7fc6d4b69776e8b592abef9539c2fc671df50

    • SHA512

      d1d5302d01fff58479385153160ab271b15f87c87cb5d7ab1df153d818ee9f109fcf8318c7622b068bb4344ab2261aca60c571e2e642d0f84e01bf15ade3c5fb

    • SSDEEP

      3072:J+oM/FJZdq/Fk96ytO/fXM+lmsolAIrRuw+mqv9j1MWLQI:C/FJaNk9Ts8+lDAA

    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects executables using Telegram Chat Bot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks