Overview
overview
10Static
static
10XWorm-Rat-...TP.dll
windows7-x64
XWorm-Rat-...TP.dll
windows10-2004-x64
1XWorm-Rat-...er.exe
windows7-x64
1XWorm-Rat-...er.exe
windows10-2004-x64
1XWorm-Rat-...ox.dll
windows7-x64
1XWorm-Rat-...ox.dll
windows10-2004-x64
1XWorm-Rat-...er.bat
windows7-x64
5XWorm-Rat-...er.bat
windows10-2004-x64
1XWorm-Rat-...I2.dll
windows7-x64
1XWorm-Rat-...I2.dll
windows10-2004-x64
1XWorm-Rat-...io.dll
windows7-x64
1XWorm-Rat-...io.dll
windows10-2004-x64
1XWorm-Rat-...NC.exe
windows7-x64
7XWorm-Rat-...NC.exe
windows10-2004-x64
7XWorm-Rat-...er.exe
windows7-x64
1XWorm-Rat-...er.exe
windows10-2004-x64
1XWorm-Rat-...UI.exe
windows7-x64
10XWorm-Rat-...UI.exe
windows10-2004-x64
10XWorm-Rat-...ib.dll
windows7-x64
1XWorm-Rat-...ib.dll
windows10-2004-x64
1XWorm-Rat-...ib.exe
windows7-x64
1XWorm-Rat-...ib.exe
windows10-2004-x64
10Resubmissions
08-06-2024 18:20
240608-wyz2hafb42 1008-06-2024 18:17
240608-ww7cssec5w 1008-06-2024 18:11
240608-ws439seb9v 1019-05-2024 22:48
240519-2rh3asfb62 10Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2024 18:11
Behavioral task
behavioral1
Sample
XWorm-Rat-Remote-Administration-Tool--main/CMSTP.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
XWorm-Rat-Remote-Administration-Tool--main/CMSTP.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
XWorm-Rat-Remote-Administration-Tool--main/DisAsClaimer.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
XWorm-Rat-Remote-Administration-Tool--main/DisAsClaimer.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
XWorm-Rat-Remote-Administration-Tool--main/FastColoredTextBox.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
XWorm-Rat-Remote-Administration-Tool--main/FastColoredTextBox.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
XWorm-Rat-Remote-Administration-Tool--main/Fixer.bat
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
XWorm-Rat-Remote-Administration-Tool--main/Fixer.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
XWorm-Rat-Remote-Administration-Tool--main/Guna.UI2.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
XWorm-Rat-Remote-Administration-Tool--main/Guna.UI2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
XWorm-Rat-Remote-Administration-Tool--main/NAudio.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
XWorm-Rat-Remote-Administration-Tool--main/NAudio.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
XWorm-Rat-Remote-Administration-Tool--main/XHVNC.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
XWorm-Rat-Remote-Administration-Tool--main/XHVNC.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
XWorm-Rat-Remote-Administration-Tool--main/XWorm-RAT-V2.1-builder.exe
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
XWorm-Rat-Remote-Administration-Tool--main/XWorm-RAT-V2.1-builder.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
XWorm-Rat-Remote-Administration-Tool--main/XWormUI.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
XWorm-Rat-Remote-Administration-Tool--main/XWormUI.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
XWorm-Rat-Remote-Administration-Tool--main/dnlib.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
XWorm-Rat-Remote-Administration-Tool--main/dnlib.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
XWorm-Rat-Remote-Administration-Tool--main/dnlib.exe
Resource
win7-20240508-en
General
-
Target
XWorm-Rat-Remote-Administration-Tool--main/NAudio.dll
-
Size
502KB
-
MD5
3b87d1363a45ce9368e9baec32c69466
-
SHA1
70a9f4df01d17060ec17df9528fca7026cc42935
-
SHA256
81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
-
SHA512
1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
-
SSDEEP
6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
Malware Config
Signatures
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\XWorm-Rat-Remote-Administration-Tool--main\NAudio.dll,#11⤵PID:3140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵PID:4204