Overview

overview

10

Static

static

10

XWorm-5.6-...er.bat

windows11-21h2-x64

5

XWorm-5.6-...ns.dll

windows11-21h2-x64

1

XWorm-5.6-...es.vbs

windows11-21h2-x64

1

XWorm-5.6-....6.exe

windows11-21h2-x64

10

XWorm-5.6-...er.exe

windows11-21h2-x64

10

Resubmissions

17/10/2024, 00:08

241017-ae5a8avalj10

17/10/2024, 00:04

241017-ac1v1s1bph10

16/10/2024, 23:52

241016-3w4p8szgmc10

16/10/2024, 23:50

241016-3v4c3szgja10

16/10/2024, 22:52

241016-2tp9ds1dkk10

Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17/10/2024, 00:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    XWorm-5.6-main/Fixer.bat
  • Size 122B
  • Sample241017-ae5a8avalj
  • SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
  • MD5 SHA1 SHA512
Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XWorm-5.6-main\Fixer.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Windows\system32\lodctr.exe
      lodctr /r
      2⤵
      • Drops file in System32 directory
      PID:3132

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        perfc007.dat
        • Path C:\Windows\System32\perfc007.dat
        • Size 44KB
        • SHA256 004818827ecc581f75674919f4605d28eed27e3f2229ae051d6849129eef40e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfc00A.dat
        • Path C:\Windows\System32\perfc00A.dat
        • Size 51KB
        • SHA256 2ddbd04182af159fbd282610381b9a265ebced2338fcafccba93556ac710f09f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfc00C.dat
        • Path C:\Windows\System32\perfc00C.dat
        • Size 43KB
        • SHA256 a7b3a2b6c67e98cf2b13684c8774113c4ed4f60cd6fc673d4c9dcb360c60ce42
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfc010.dat
        • Path C:\Windows\System32\perfc010.dat
        • Size 46KB
        • SHA256 f6847323dd961aef9230bca3409a01b7c4e5e16dcca8a2e2417c9dc750871cf6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfc011.dat
        • Path C:\Windows\System32\perfc011.dat
        • Size 32KB
        • SHA256 33295c7ee1b56a41e809432bc25dd745ba55b2dc91bfa97aa1f55156880cd71a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfh007.dat
        • Path C:\Windows\System32\perfh007.dat
        • Size 307KB
        • SHA256 ca3f8056e3e2378509ab24f8b8471e5fccac403a5413be518ac35bbb42a2e2cf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfh009.dat
        • Path C:\Windows\System32\perfh009.dat
        • Size 297KB
        • SHA256 9a60acb9d0cb67b40154feb3ff45119f122301ee059798c87a02cc0c23e2ffce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfh00A.dat
        • Path C:\Windows\System32\perfh00A.dat
        • Size 338KB
        • SHA256 e7c22cb8443fb549de7a3e826645450ed47169ce0168c740096de44addd360dd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfh00C.dat
        • Path C:\Windows\System32\perfh00C.dat
        • Size 363KB
        • SHA256 68a7924621a0fbc13d0ea151617d13732a991cef944aae67d44fc030740a82e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfh010.dat
        • Path C:\Windows\System32\perfh010.dat
        • Size 353KB
        • SHA256 494db162e2ccd95e69404a34170b6e59847f444881834f3c175c6bc70d783087
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        perfh011.dat
        • Path C:\Windows\System32\perfh011.dat
        • Size 158KB
        • SHA256 eca01d5405d7e8af92ea60f888f891415ea2e1e6484caff15cbaf5a645700db2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download