General
-
Target
holy moly this is a good executor gui.rbxm
-
Size
11KB
-
Sample
240525-k1wajscc4t
-
MD5
639065fa41416b84bba8221645b5d40b
-
SHA1
56965ae8ea0898412cbf69ef3d514b954caf4b4e
-
SHA256
6042353e1bf948080c9d90a74fe59735cbb93c1c2c302679f800d3096911c9a0
-
SHA512
994b8509b6bab739cda3417acd7edc6a60dc50850f610c30c73e14f70d3c576c750f9f6d9c2f59d260bab5abad3494cf69157c636385959895d3b0c1d9de9805
-
SSDEEP
96:VQIeF23/wF3bssf3QFzxx80ZvCNkS1Km3RKQlEK6m3JEP/P8E:VQIeQ8IsfiVxNRCNkS1KARrlEK6AeH8E
Static task
static1
Behavioral task
behavioral1
Sample
holy moly this is a good executor gui.rbxm
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
5.0
127.0.0.1:7777
45.145.41.147:7777
5N4ZirqATbPp1e8c
-
Install_directory
%ProgramData%
-
install_file
WinBackup.exe
Targets
-
-
Target
holy moly this is a good executor gui.rbxm
-
Size
11KB
-
MD5
639065fa41416b84bba8221645b5d40b
-
SHA1
56965ae8ea0898412cbf69ef3d514b954caf4b4e
-
SHA256
6042353e1bf948080c9d90a74fe59735cbb93c1c2c302679f800d3096911c9a0
-
SHA512
994b8509b6bab739cda3417acd7edc6a60dc50850f610c30c73e14f70d3c576c750f9f6d9c2f59d260bab5abad3494cf69157c636385959895d3b0c1d9de9805
-
SSDEEP
96:VQIeF23/wF3bssf3QFzxx80ZvCNkS1Km3RKQlEK6m3JEP/P8E:VQIeQ8IsfiVxNRCNkS1KARrlEK6AeH8E
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1