Overview
overview
10Static
static
3XWorm.rar
windows10-2004-x64
6ComponentF...it.dll
windows10-2004-x64
1ComponentF...it.pdb
windows10-2004-x64
3D3DX9_43.dll
windows10-2004-x64
1Krypton.Toolkit.dll
windows10-2004-x64
1Mono.Cecil.dll
windows10-2004-x64
1Mono.Nat.dll
windows10-2004-x64
1VMProtectSDK64.lib
windows10-2004-x64
3Vestris.Re...ib.dll
windows10-2004-x64
1XWorm.xml
windows10-2004-x64
1XWorm.exe
windows10-2004-x64
10imgui.ini
windows10-2004-x64
1Analysis
- max time kernel
1794s - max time network
1799s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 16:39
Static task
static1
Behavioral task
behavioral1
Sample
XWorm.rar
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
ComponentFactory.Krypton.Toolkit.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
ComponentFactory.Krypton.Toolkit.pdb
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
D3DX9_43.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Krypton.Toolkit.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
Mono.Cecil.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Mono.Nat.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
VMProtectSDK64.lib
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
Vestris.ResourceLib.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
XWorm.xml
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
XWorm.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
imgui.ini
Resource
win10v2004-20240508-en
General
- Target Mono.Nat.dll
- Size 40KB
- Sample240605-t53d4ada22
- SHA256 b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0
- MD5 bf929442b12d4b5f9906b29834bf7db1
- SHA1 810a2b3c8e548d1df931538bc304cc1405f7a32b
- SHA512 9fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828
- SSDEEP 768:yoVesKx0V2LpibQJxoKUDHj560aSX3zlJAO:lVespQibC+H56k3fF
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Mono.Nat.dll,#11⤵PID:3112
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4008,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:81⤵PID:3240
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4052,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:81⤵PID:1668