1836e05f25dddf9426969e13ab80d1dcdf8d7b496b1a05d98ebae9303c18b956

General

Target

XWorm V5.6.zip
Size

25.2MB
MD5

3df07d8344e5800f75f38fdade2aaec0
SHA1

133feffb7e48be2ce194324972d6e0424f2fd52f
SHA256

1836e05f25dddf9426969e13ab80d1dcdf8d7b496b1a05d98ebae9303c18b956
SHA512

38b91983dbc23e6bbb3443045aea54952f93da08ce68aa661583c9522c30a9e22a1c16bf99bfdc6a39a8a4bae353ef12ba978357ab8a3315fde2275bc4ff8579
SSDEEP

393216:Cv6y2gszSnnHTrQWQD59U/p+HZZPz+NJWRL4UPBu+89YWOcC16kh0upLTLrD9dO6:MwSnHTm59UhfJWRbPwYiC1euNrbO6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1092	Xworm V5.6.exe
1588	XwormLoader.exe
2408	XwormLoader.exe
3308	XwormLoader.exe

Loads dropped DLL 3 IoCs

pid	Process
1588	XwormLoader.exe
2408	XwormLoader.exe
3308	XwormLoader.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 4364	1588	XwormLoader.exe	88
PID 2408 set thread context of 1280	2408	XwormLoader.exe	91
PID 3308 set thread context of 1080	3308	XwormLoader.exe	94

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XwormLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XwormLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XwormLoader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V5.6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	7zFM.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeRestorePrivilege	3020	7zFM.exe
Token: 35	3020	7zFM.exe
Token: SeSecurityPrivilege	3020	7zFM.exe
Token: SeSecurityPrivilege	3020	7zFM.exe
Token: SeSecurityPrivilege	3020	7zFM.exe
Token: SeDebugPrivilege	4364	MSBuild.exe
Token: SeBackupPrivilege	4364	MSBuild.exe
Token: SeSecurityPrivilege	4364	MSBuild.exe
Token: SeSecurityPrivilege	4364	MSBuild.exe
Token: SeSecurityPrivilege	4364	MSBuild.exe
Token: SeSecurityPrivilege	4364	MSBuild.exe
Token: SeDebugPrivilege	1280	MSBuild.exe
Token: SeBackupPrivilege	1280	MSBuild.exe
Token: SeSecurityPrivilege	1280	MSBuild.exe
Token: SeSecurityPrivilege	1280	MSBuild.exe
Token: SeSecurityPrivilege	1280	MSBuild.exe
Token: SeSecurityPrivilege	1280	MSBuild.exe
Token: SeDebugPrivilege	1080	MSBuild.exe
Token: SeBackupPrivilege	1080	MSBuild.exe
Token: SeSecurityPrivilege	1080	MSBuild.exe
Token: SeSecurityPrivilege	1080	MSBuild.exe
Token: SeSecurityPrivilege	1080	MSBuild.exe
Token: SeSecurityPrivilege	1080	MSBuild.exe
Token: SeBackupPrivilege	4364	MSBuild.exe
Token: SeSecurityPrivilege	4364	MSBuild.exe
Token: SeSecurityPrivilege	4364	MSBuild.exe
Token: SeSecurityPrivilege	4364	MSBuild.exe
Token: SeSecurityPrivilege	4364	MSBuild.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3020	7zFM.exe
3020	7zFM.exe
3020	7zFM.exe
3020	7zFM.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4364	1588	XwormLoader.exe	88
PID 1588 wrote to memory of 4364	1588	XwormLoader.exe	88
PID 1588 wrote to memory of 4364	1588	XwormLoader.exe	88
PID 1588 wrote to memory of 4364	1588	XwormLoader.exe	88
PID 1588 wrote to memory of 4364	1588	XwormLoader.exe	88
PID 1588 wrote to memory of 4364	1588	XwormLoader.exe	88
PID 1588 wrote to memory of 4364	1588	XwormLoader.exe	88
PID 1588 wrote to memory of 4364	1588	XwormLoader.exe	88
PID 2408 wrote to memory of 1280	2408	XwormLoader.exe	91
PID 2408 wrote to memory of 1280	2408	XwormLoader.exe	91
PID 2408 wrote to memory of 1280	2408	XwormLoader.exe	91
PID 2408 wrote to memory of 1280	2408	XwormLoader.exe	91
PID 2408 wrote to memory of 1280	2408	XwormLoader.exe	91
PID 2408 wrote to memory of 1280	2408	XwormLoader.exe	91
PID 2408 wrote to memory of 1280	2408	XwormLoader.exe	91
PID 2408 wrote to memory of 1280	2408	XwormLoader.exe	91
PID 3308 wrote to memory of 1080	3308	XwormLoader.exe	94
PID 3308 wrote to memory of 1080	3308	XwormLoader.exe	94
PID 3308 wrote to memory of 1080	3308	XwormLoader.exe	94
PID 3308 wrote to memory of 1080	3308	XwormLoader.exe	94
PID 3308 wrote to memory of 1080	3308	XwormLoader.exe	94
PID 3308 wrote to memory of 1080	3308	XwormLoader.exe	94
PID 3308 wrote to memory of 1080	3308	XwormLoader.exe	94
PID 3308 wrote to memory of 1080	3308	XwormLoader.exe	94

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1652

C:\Users\Admin\Desktop\XWorm V5.6\Xworm V5.6.exe
"C:\Users\Admin\Desktop\XWorm V5.6\Xworm V5.6.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
PID:1092

C:\Users\Admin\Desktop\XWorm V5.6\XwormLoader.exe
"C:\Users\Admin\Desktop\XWorm V5.6\XwormLoader.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4364

C:\Users\Admin\Desktop\XWorm V5.6\XwormLoader.exe
"C:\Users\Admin\Desktop\XWorm V5.6\XwormLoader.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1280

C:\Users\Admin\Desktop\XWorm V5.6\XwormLoader.exe
"C:\Users\Admin\Desktop\XWorm V5.6\XwormLoader.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XwormLoader.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
799KB

MD5
5c79d44ff8563412dce1bb36626781d6

SHA1
a13da89b3ec6becd64e1a5aa2780bde27b4bc467

SHA256
ecea21c9c2bd359747693dc3d34db8338547fdae7f06739336daa3d826a85135

SHA512
25e594e2526e76307f67ebec73bb3c8d96fc4a4b170d8fdffead41b798a00ede67e0fbe3e3d99b54ce424c356a10a262312149d84d76c8248464b135c7cd3d18

Download Submit
C:\Users\Admin\Desktop\XWorm V5.6\Guna.UI2.dll

Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Desktop\XWorm V5.6\Xworm V5.6.exe

Filesize
14.9MB

MD5
56ccb739926a725e78a7acf9af52c4bb

SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc

SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

Download Submit
C:\Users\Admin\Desktop\XWorm V5.6\Xworm V5.6.exe.config

Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
C:\Users\Admin\Desktop\XWorm V5.6\XwormLoader.exe

Filesize
576KB

MD5
f1a4c690564f491ad4f7fc8ce79e2fc3

SHA1
cc16274baae2af0c614566d56b693774fe892168

SHA256
0a3555b2ab1f76066c496eb43ebc520c82824a22cfcb714a75c5edc1ad99d88a

SHA512
f7a1116b889493c079000847f5517e9149d5dce703b85b1520ad1d4810c575500aab47460a6e0d7e266fa5ef70ba10d4b625587725251734404913844897e180

Download Submit
memory/1092-487-0x00007FFEE8773000-0x00007FFEE8775000-memory.dmp

Filesize
8KB

Download
memory/1092-491-0x000002A4F3870000-0x000002A4F3A64000-memory.dmp

Filesize
2.0MB

Download
memory/1092-489-0x00007FFEE8770000-0x00007FFEE9232000-memory.dmp

Filesize
10.8MB

Download
memory/1092-488-0x000002A4EE520000-0x000002A4EF408000-memory.dmp

Filesize
14.9MB

Download
memory/1092-522-0x00007FFEE8770000-0x00007FFEE9232000-memory.dmp

Filesize
10.8MB

Download
memory/1092-509-0x00007FFEE8773000-0x00007FFEE8775000-memory.dmp

Filesize
8KB

Download
memory/1588-494-0x00000000007A0000-0x000000000083A000-memory.dmp

Filesize
616KB

Download
memory/1588-495-0x0000000005320000-0x0000000005326000-memory.dmp

Filesize
24KB

Download
memory/4364-502-0x0000000000580000-0x000000000062E000-memory.dmp

Filesize
696KB

Download
memory/4364-506-0x0000000004C00000-0x0000000004C0A000-memory.dmp

Filesize
40KB

Download
memory/4364-505-0x0000000004C60000-0x0000000004CF2000-memory.dmp

Filesize
584KB

Download
memory/4364-517-0x0000000007E90000-0x00000000084A8000-memory.dmp

Filesize
6.1MB

Download
memory/4364-518-0x00000000079F0000-0x0000000007AFA000-memory.dmp

Filesize
1.0MB

Download
memory/4364-519-0x0000000007940000-0x0000000007952000-memory.dmp

Filesize
72KB

Download
memory/4364-520-0x00000000079A0000-0x00000000079DC000-memory.dmp

Filesize
240KB

Download
memory/4364-521-0x0000000007B00000-0x0000000007B4C000-memory.dmp

Filesize
304KB

Download
memory/4364-504-0x0000000005120000-0x00000000056C6000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing