Analysis
-
max time kernel
48s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 15:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
XWorm.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
1200 seconds
General
-
Target
XWorm.exe
-
Size
456KB
-
MD5
515a0c8be21a5ba836e5687fc2d73333
-
SHA1
c52be9d0d37ac1b8d6bc09860e68e9e0615255ab
-
SHA256
9950788284df125c7359aeb91435ed24d59359fac6a74ed73774ca31561cc7ae
-
SHA512
4e2bd7ce844bba25aff12e2607c4281b59f7579b9407139ef6136ef09282c7afac1c702adebc42f8bd7703fac047fd8b5add34df334bfc04d3518ea483225522
-
SSDEEP
6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+V:2uWP/BZUyoLu8Agsmxwrvejkd2
Score
10/10
Malware Config
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
resource yara_rule behavioral1/memory/4464-1-0x00000000025A0000-0x00000000029A0000-memory.dmp family_rhadamanthys behavioral1/memory/4464-2-0x00000000025A0000-0x00000000029A0000-memory.dmp family_rhadamanthys behavioral1/memory/4464-3-0x00000000025A0000-0x00000000029A0000-memory.dmp family_rhadamanthys behavioral1/memory/4464-4-0x00000000025A0000-0x00000000029A0000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI XWorm.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI XWorm.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI XWorm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 XWorm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID XWorm.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4464 XWorm.exe 4464 XWorm.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeShutdownPrivilege 4464 XWorm.exe Token: SeCreatePagefilePrivilege 4464 XWorm.exe Token: SeDebugPrivilege 3036 firefox.exe Token: SeDebugPrivilege 3036 firefox.exe Token: SeDebugPrivilege 468 taskmgr.exe Token: SeSystemProfilePrivilege 468 taskmgr.exe Token: SeCreateGlobalPrivilege 468 taskmgr.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 3036 firefox.exe 3036 firefox.exe 3036 firefox.exe 3036 firefox.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe -
Suspicious use of SendNotifyMessage 36 IoCs
pid Process 3036 firefox.exe 3036 firefox.exe 3036 firefox.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3036 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 4256 wrote to memory of 3036 4256 firefox.exe 85 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 1588 3036 firefox.exe 86 PID 3036 wrote to memory of 4088 3036 firefox.exe 87 PID 3036 wrote to memory of 4088 3036 firefox.exe 87 PID 3036 wrote to memory of 4088 3036 firefox.exe 87 PID 3036 wrote to memory of 4088 3036 firefox.exe 87 PID 3036 wrote to memory of 4088 3036 firefox.exe 87 PID 3036 wrote to memory of 4088 3036 firefox.exe 87 PID 3036 wrote to memory of 4088 3036 firefox.exe 87 PID 3036 wrote to memory of 4088 3036 firefox.exe 87 PID 3036 wrote to memory of 4088 3036 firefox.exe 87 PID 3036 wrote to memory of 4088 3036 firefox.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm.exe"C:\Users\Admin\AppData\Local\Temp\XWorm.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.0.750556129\918930118" -parentBuildID 20230214051806 -prefsHandle 1776 -prefMapHandle 1768 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e1fd8e8-73e4-4278-ad9c-175e01db1329} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 1868 2259b70d458 gpu3⤵PID:1588
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.1.749533236\947780033" -parentBuildID 20230214051806 -prefsHandle 2424 -prefMapHandle 2420 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c45a115d-70fa-4473-8aef-58e92924740c} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 2436 2258e989058 socket3⤵
- Checks processor information in registry
PID:4088
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.2.89039972\1924608757" -childID 1 -isForBrowser -prefsHandle 3012 -prefMapHandle 3008 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0da0895-39e6-44cf-a06a-09bbfd9f2e99} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 3024 2259dfe5b58 tab3⤵PID:3696
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.3.1941230983\1319138961" -childID 2 -isForBrowser -prefsHandle 4216 -prefMapHandle 4212 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d8a1426-0993-4077-8188-73840209f89f} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 4228 225a0b85258 tab3⤵PID:456
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.4.1974113791\240704970" -childID 3 -isForBrowser -prefsHandle 5024 -prefMapHandle 5048 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {187ec02a-0f99-4922-96e8-3b8a2c3ca7ae} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 5060 225a2d95558 tab3⤵PID:4924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.5.1423814188\450619804" -childID 4 -isForBrowser -prefsHandle 5244 -prefMapHandle 5240 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c53a2477-4c3a-4290-a22a-35b4a905d482} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 5252 225a2d94f58 tab3⤵PID:4940
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.6.864052172\1688811579" -childID 5 -isForBrowser -prefsHandle 5148 -prefMapHandle 5152 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30c4bba2-08c5-43fa-b25b-5a8ace1ae0d5} 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 5140 225a2d92b58 tab3⤵PID:3944
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:468
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2280
-
C:\Windows\System32\rpvymf.exe"C:\Windows\System32\rpvymf.exe"1⤵PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\activity-stream.discovery_stream.json.tmp
Filesize26KB
MD5f1b2f25b01ffa7cfadf7134fbecb0ec6
SHA153a5604ce68b4ef3ba3760318555c14ea7fdea84
SHA256d32fb35d95b092fe826f2554c02c2e04f38c48f30f8822595d14f9e082b244dd
SHA51221dd1fd890538d8c38172282fb9a68139edc9d58584a590bdef89f9a5db07809c3fc941d2ac0746b1a6df3c8413cc199cdf98529b114e434399667e6828e52e5
-
Filesize
7KB
MD5a36b76bca41910c3575674f693ca1109
SHA18d71e459f9e7497ad99a70f0f2baaaddff44b865
SHA256df4012d2c9892151ead1f59fdab0b7119ada15282adf65a728cb9677e4465c4d
SHA512de7019dbb2ce9bed30f09809d5a02b787dbfc9eda8aebf49b84f46e677bbaefd2ae5916ffbb5f969fe29f1b03e27f8e2cc097cceaae2b96bb9d1c187ed39bd4e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore.jsonlz4
Filesize923B
MD5956281913d3f732a5badd4622dceba8e
SHA1bfe2532a2d6b2ddd432707fb9d84cb1707b2d3b3
SHA2565dad8af635e223af5f3ca8e1915e35035b6c0e7d88b65495a730de19c951cc0b
SHA512be428a75c5fb9d2356ab17d929a9c95afdcb7b041b50e8a1215c8e6f56147d96a3d7c0ae165f1b6e7c1e84e04fe8b78fa74615da8aef58f344d4a8b3bdebb4d9