Overview

overview

10

Static

static

3

RazerSynap...60.exe

windows7-x64

8

RazerSynap...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RazerSynapseInstaller_v1.17.0.60.exe

  • Size

    8.5MB

  • Sample

    240609-rred1acb73

  • MD5

    a0642233210e8926d9fce8c249054bb2

  • SHA1

    f9f1ef1e4d58c85a7f1bd9be91b5efb8dac78acb

  • SHA256

    86fc45a637f30313b5af7d6264b1db58affa024daba9a7eb1aac18b4300b906a

  • SHA512

    2ee4b4c31ef2209c8262e0f63a0574ca6307f520895e45828a698e6ac907769c4f525e23b5d99515adbb7f1d7fb584fdaa680a6ce5346458c9de468090c106e9

  • SSDEEP

    196608:pEVh1uFf0Dc2GG0OqLaIw1vBUvt1RUMnlXw5aKJRsvLuXCWBvOuFf0Dc2GF2:WVVqLaIo5UvNA5pJRsSTvK

Score
10/10
xwormexecutionrattrojan

Malware Config

Extracted

Family

xworm

C2

done-declared.gl.at.ply.gg:43143

Attributes
  • install_file

    USB.exe

Targets

    • Target

      RazerSynapseInstaller_v1.17.0.60.exe

    • Size

      8.5MB

    • MD5

      a0642233210e8926d9fce8c249054bb2

    • SHA1

      f9f1ef1e4d58c85a7f1bd9be91b5efb8dac78acb

    • SHA256

      86fc45a637f30313b5af7d6264b1db58affa024daba9a7eb1aac18b4300b906a

    • SHA512

      2ee4b4c31ef2209c8262e0f63a0574ca6307f520895e45828a698e6ac907769c4f525e23b5d99515adbb7f1d7fb584fdaa680a6ce5346458c9de468090c106e9

    • SSDEEP

      196608:pEVh1uFf0Dc2GG0OqLaIw1vBUvt1RUMnlXw5aKJRsvLuXCWBvOuFf0Dc2GF2:WVVqLaIo5UvNA5pJRsSTvK

    Score
    10/10
    executionxwormrattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks