Overview

overview

10

Static

static

10

3bc839c36e...cb.exe

windows7-x64

10

3bc839c36e...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3bc839c36e16d08250bc4403d581ab822e5bb251be4c75097ffed5e29d5fe1cb.exe

  • Size

    61KB

  • Sample

    240522-rtd61sec95

  • MD5

    cd957aab73baa2b3aa0fd281f7d58a94

  • SHA1

    14970a8f02e6a4094c12eaca2a6e051a714335cf

  • SHA256

    3bc839c36e16d08250bc4403d581ab822e5bb251be4c75097ffed5e29d5fe1cb

  • SHA512

    861872ac6e2305d39efed9e2683595ccd11d6a977988def777a1c62c74ebe2e858ba90fed2f19cccf49379f1331dda9077a21f84d90ff700fe882243978ba5c3

  • SSDEEP

    1536:ZyE+lRntKWfjXlUQkbyk1WwTS9O4aWGdaB:ZARtKW7XllkbyBwsO4SC

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

169.254.90.187:7000

143.198.155.177:7000
Attributes
  • Install_directory

    %Temp%

  • install_file

    XClient.exe

Targets

    • Target

      3bc839c36e16d08250bc4403d581ab822e5bb251be4c75097ffed5e29d5fe1cb.exe

    • Size

      61KB

    • MD5

      cd957aab73baa2b3aa0fd281f7d58a94

    • SHA1

      14970a8f02e6a4094c12eaca2a6e051a714335cf

    • SHA256

      3bc839c36e16d08250bc4403d581ab822e5bb251be4c75097ffed5e29d5fe1cb

    • SHA512

      861872ac6e2305d39efed9e2683595ccd11d6a977988def777a1c62c74ebe2e858ba90fed2f19cccf49379f1331dda9077a21f84d90ff700fe882243978ba5c3

    • SSDEEP

      1536:ZyE+lRntKWfjXlUQkbyk1WwTS9O4aWGdaB:ZARtKW7XllkbyBwsO4SC

    Score
    10/10
    xwormpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks