General
-
Target
a788a5b401661ff1c3eedd21d679ccaf39a35cb1a5a814773b1e4ded48de890c.exe
-
Size
121KB
-
Sample
240621-bv923svcqa
-
MD5
5ad0a139daa10def6783d34a578882eb
-
SHA1
8cbeb48832356f7cff9b1370ece879d72b8eb156
-
SHA256
a788a5b401661ff1c3eedd21d679ccaf39a35cb1a5a814773b1e4ded48de890c
-
SHA512
2cbd28e71e57b1fa051231565074afeaaacb6332c831e861be45e98eab1d1f1fc0519ddbace3f2f2f24d9a97d8dd767bcfadd827dfb81e960bcc7b73cb5b3b84
-
SSDEEP
1536:S0DwewicrbsN/YVRrNRF49IG6iOwjaClJEHIl7pmhaKI:S0DweDN/kr/F49IaOw5Ch0
Behavioral task
behavioral1
Sample
a788a5b401661ff1c3eedd21d679ccaf39a35cb1a5a814773b1e4ded48de890c.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a788a5b401661ff1c3eedd21d679ccaf39a35cb1a5a814773b1e4ded48de890c.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
5.0
sekoneko.zapto.org:1111
epkUNO9aHruE9KEn
-
Install_directory
%AppData%
-
install_file
win64.exe
Targets
-
-
Target
a788a5b401661ff1c3eedd21d679ccaf39a35cb1a5a814773b1e4ded48de890c.exe
-
Size
121KB
-
MD5
5ad0a139daa10def6783d34a578882eb
-
SHA1
8cbeb48832356f7cff9b1370ece879d72b8eb156
-
SHA256
a788a5b401661ff1c3eedd21d679ccaf39a35cb1a5a814773b1e4ded48de890c
-
SHA512
2cbd28e71e57b1fa051231565074afeaaacb6332c831e861be45e98eab1d1f1fc0519ddbace3f2f2f24d9a97d8dd767bcfadd827dfb81e960bcc7b73cb5b3b84
-
SSDEEP
1536:S0DwewicrbsN/YVRrNRF49IG6iOwjaClJEHIl7pmhaKI:S0DweDN/kr/F49IaOw5Ch0
-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1