Analysis
- max time kernel
1793s - max time network
1564s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
- submitted
07/08/2024, 17:15
General
- Target XWorm.V5.2.rar
- Size 30.4MB
- Sample240807-vs2gps1dlm
- SHA256 6a4beba8dda5d6d9b9f301c6bcf100b05d8c192453ee7d293efbe95f9a0f76c9
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\XWorm.V5.2.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\XWorm.V5.2.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\XWorm.V5.2.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\XWorm.V5.2.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2292-30-0x000007FEFADF0000-0x000007FEFAE24000-memory.dmp
memory/2292-29-0x000000013F960000-0x000000013FA58000-memory.dmp
memory/2292-32-0x000007FEFADD0000-0x000007FEFADE8000-memory.dmp
memory/2292-37-0x000007FEF6AF0000-0x000007FEF6B0D000-memory.dmp
memory/2292-38-0x000007FEF6AD0000-0x000007FEF6AE1000-memory.dmp
memory/2292-36-0x000007FEF6B10000-0x000007FEF6B21000-memory.dmp
memory/2292-35-0x000007FEFAD70000-0x000007FEFAD87000-memory.dmp
memory/2292-34-0x000007FEFAD90000-0x000007FEFADA1000-memory.dmp
memory/2292-33-0x000007FEFADB0000-0x000007FEFADC7000-memory.dmp
memory/2292-31-0x000007FEF5A80000-0x000007FEF5D36000-memory.dmp
memory/2292-39-0x000007FEF5740000-0x000007FEF594B000-memory.dmp
memory/2292-41-0x000007FEF6A80000-0x000007FEF6AC1000-memory.dmp
memory/2292-42-0x000007FEF6A50000-0x000007FEF6A71000-memory.dmp
memory/2292-43-0x000007FEF6A30000-0x000007FEF6A48000-memory.dmp
memory/2292-44-0x000007FEF6290000-0x000007FEF62A1000-memory.dmp
memory/2292-65-0x000007FEEFAF0000-0x000007FEEFB06000-memory.dmp
memory/2292-64-0x000007FEF1290000-0x000007FEF12A1000-memory.dmp
memory/2292-63-0x000007FEF12B0000-0x000007FEF12DF000-memory.dmp
memory/2292-62-0x000007FEFB090000-0x000007FEFB0A0000-memory.dmp
memory/2292-61-0x000007FEF6BE0000-0x000007FEF6BF7000-memory.dmp
memory/2292-60-0x000007FEF43E0000-0x000007FEF43F2000-memory.dmp
memory/2292-59-0x000007FEF4400000-0x000007FEF4411000-memory.dmp
memory/2292-58-0x000007FEF4420000-0x000007FEF4443000-memory.dmp
memory/2292-57-0x000007FEF4450000-0x000007FEF4468000-memory.dmp
memory/2292-56-0x000007FEF4470000-0x000007FEF4494000-memory.dmp
memory/2292-54-0x000007FEF44D0000-0x000007FEF4527000-memory.dmp
memory/2292-53-0x000007FEF4530000-0x000007FEF4541000-memory.dmp
memory/2292-52-0x000007FEF4550000-0x000007FEF45CC000-memory.dmp
memory/2292-51-0x000007FEF45D0000-0x000007FEF4637000-memory.dmp
memory/2292-50-0x000007FEF4640000-0x000007FEF4670000-memory.dmp
memory/2292-49-0x000007FEF4670000-0x000007FEF4688000-memory.dmp
memory/2292-48-0x000007FEF60F0000-0x000007FEF6101000-memory.dmp
memory/2292-47-0x000007FEF6110000-0x000007FEF612B000-memory.dmp
memory/2292-46-0x000007FEF6130000-0x000007FEF6141000-memory.dmp
memory/2292-45-0x000007FEF6150000-0x000007FEF6161000-memory.dmp
memory/2292-40-0x000007FEF4690000-0x000007FEF5740000-memory.dmp
memory/2292-55-0x000007FEF44A0000-0x000007FEF44C8000-memory.dmp
memory/2292-66-0x000007FEEFA20000-0x000007FEEFAE5000-memory.dmp
memory/2292-67-0x000007FEEF9D0000-0x000007FEEFA12000-memory.dmp
memory/2292-68-0x000007FEEF3A0000-0x000007FEEF402000-memory.dmp
memory/2292-69-0x000007FEEF330000-0x000007FEEF39D000-memory.dmp