Overview

overview

10

Static

static

3

30dc2290b6...cs.exe

windows7-x64

10

30dc2290b6...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30dc2290b6b7bad31e59c18d4550117c79a7c36aeb09ca5f54714579adce11a2_NeikiAnalytics.exe

  • Size

    808KB

  • Sample

    240620-eff28s1hmk

  • MD5

    97f0e987446dc19d888bff693ae44eb0

  • SHA1

    5f8f941d3197cb6c0b314e966d677ad3e340594c

  • SHA256

    30dc2290b6b7bad31e59c18d4550117c79a7c36aeb09ca5f54714579adce11a2

  • SHA512

    a5ee9ee3779ea9e579f7f41d0a98d433f2b0f12ee64f6f234612a53b1b29772b7384ecbcdef262dff68ca113a8eea8135e19321fa4efc1fca329acf0e1801e44

  • SSDEEP

    12288:iRhNJJWyiyLqgqXGb0krJIDnv44WpPCaq8hFVZwyWgG0DOFdgf0FBPdAA:wWuLqCOT44WphTZjGPFdBA

Score
10/10
vjw0rmxwormexecutionrattrojanworm

Malware Config

Extracted

Family

xworm

C2

192.168.1.8:7000

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClienamrt.exe

Targets

    • Target

      30dc2290b6b7bad31e59c18d4550117c79a7c36aeb09ca5f54714579adce11a2_NeikiAnalytics.exe

    • Size

      808KB

    • MD5

      97f0e987446dc19d888bff693ae44eb0

    • SHA1

      5f8f941d3197cb6c0b314e966d677ad3e340594c

    • SHA256

      30dc2290b6b7bad31e59c18d4550117c79a7c36aeb09ca5f54714579adce11a2

    • SHA512

      a5ee9ee3779ea9e579f7f41d0a98d433f2b0f12ee64f6f234612a53b1b29772b7384ecbcdef262dff68ca113a8eea8135e19321fa4efc1fca329acf0e1801e44

    • SSDEEP

      12288:iRhNJJWyiyLqgqXGb0krJIDnv44WpPCaq8hFVZwyWgG0DOFdgf0FBPdAA:wWuLqCOT44WphTZjGPFdBA

    Score
    10/10
    vjw0rmxwormexecutionrattrojanworm

    • Detect Xworm Payload

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

JavaScript

1
T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks