General

  • Target

    a788a5b401661ff1c3eedd21d679ccaf39a35cb1a5a814773b1e4ded48de890c.exe

  • Size

    121KB

  • Sample

    240621-bv923svcqa

  • MD5

    5ad0a139daa10def6783d34a578882eb

  • SHA1

    8cbeb48832356f7cff9b1370ece879d72b8eb156

  • SHA256

    a788a5b401661ff1c3eedd21d679ccaf39a35cb1a5a814773b1e4ded48de890c

  • SHA512

    2cbd28e71e57b1fa051231565074afeaaacb6332c831e861be45e98eab1d1f1fc0519ddbace3f2f2f24d9a97d8dd767bcfadd827dfb81e960bcc7b73cb5b3b84

  • SSDEEP

    1536:S0DwewicrbsN/YVRrNRF49IG6iOwjaClJEHIl7pmhaKI:S0DweDN/kr/F49IaOw5Ch0

Malware Config

Extracted

Family

xworm

Version

5.0

C2

sekoneko.zapto.org:1111

Mutex

epkUNO9aHruE9KEn

Attributes
  • Install_directory

    %AppData%

  • install_file

    win64.exe

aes.plain

Targets

    • Target

      a788a5b401661ff1c3eedd21d679ccaf39a35cb1a5a814773b1e4ded48de890c.exe

    • Size

      121KB

    • MD5

      5ad0a139daa10def6783d34a578882eb

    • SHA1

      8cbeb48832356f7cff9b1370ece879d72b8eb156

    • SHA256

      a788a5b401661ff1c3eedd21d679ccaf39a35cb1a5a814773b1e4ded48de890c

    • SHA512

      2cbd28e71e57b1fa051231565074afeaaacb6332c831e861be45e98eab1d1f1fc0519ddbace3f2f2f24d9a97d8dd767bcfadd827dfb81e960bcc7b73cb5b3b84

    • SSDEEP

      1536:S0DwewicrbsN/YVRrNRF49IG6iOwjaClJEHIl7pmhaKI:S0DweDN/kr/F49IaOw5Ch0

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks