General
-
Target
Background.zip
-
Size
42.7MB
-
Sample
240802-21cxmsyenf
-
MD5
e953ce51e22c8c7f91a5c39070e035e3
-
SHA1
36b39e46b4080e547729e9efe61cfdf6dda1da47
-
SHA256
a6e8143988cc3cec60fa43802be8a1e4e7ca5d0b5240b4897091c1a857d71144
-
SHA512
cd4b3461d88c6c534a5d18e45a0c15321c534f0c77cb43c2b1019af8945f0d6cfd8c76da35109f6b60a1f80c465559ff84ddc138e96d5585293d18403adba22d
-
SSDEEP
786432:pCxgXxrCT0kw0E4w+p+xU8BafhLn9+2lxpFMXLAsjm03JKnb9by8U0/4lwtdA8Z3:xXxrCTvbExU8IrNhMXLe2KnJQ0/4lsbp
Behavioral task
behavioral1
Sample
Background.zip
Resource
win7-20240705-en
Malware Config
Extracted
xworm
31.167.24.129:7000
154.61.71.50:7000
2.90.87.156:7000
86.96.100.98:7000
-
Install_directory
%Temp%
-
install_file
USB.exe
Extracted
xworm
5.0
127.0.0.1:7000
JYj1EIwWwj45bGVr
-
Install_directory
%AppData%
-
install_file
XClient.exe
Targets
-
-
Target
Background.zip
-
Size
42.7MB
-
MD5
e953ce51e22c8c7f91a5c39070e035e3
-
SHA1
36b39e46b4080e547729e9efe61cfdf6dda1da47
-
SHA256
a6e8143988cc3cec60fa43802be8a1e4e7ca5d0b5240b4897091c1a857d71144
-
SHA512
cd4b3461d88c6c534a5d18e45a0c15321c534f0c77cb43c2b1019af8945f0d6cfd8c76da35109f6b60a1f80c465559ff84ddc138e96d5585293d18403adba22d
-
SSDEEP
786432:pCxgXxrCT0kw0E4w+p+xU8BafhLn9+2lxpFMXLAsjm03JKnb9by8U0/4lwtdA8Z3:xXxrCTvbExU8IrNhMXLe2KnJQ0/4lsbp
-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Download via BitsAdmin
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
BITS Jobs
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1