Analysis
-
max time kernel
250s -
max time network
227s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
17-10-2024 11:02
General
-
Target
XWorm-5.6-main.zip
-
Size
25.1MB
-
MD5
95c1c4a3673071e05814af8b2a138be4
-
SHA1
4c08b79195e0ff13b63cfb0e815a09dc426ac340
-
SHA256
7c270da2506ba3354531e0934096315422ee719ad9ea16cb1ee86a7004a9ce27
-
SHA512
339a47ecfc6d403beb55d51128164a520c4bea63733be3cfd47aec47953fbf2792aa4e150f4122994a7620122b0e0fc20c1eeb2f9697cf5578df08426820fecd
-
SSDEEP
786432:Ty5jMDNnx2+4NYobtH8VVtKqi9+i514XZ/pjYlp0:MMDNnxV4iobxibiIi5MpjYv0
Malware Config
Extracted
lumma
https://pillowbrocccolipe.shop/api
https://communicationgenerwo.shop/api
https://diskretainvigorousiw.shop/api
https://affordcharmcropwo.shop/api
https://dismissalcylinderhostw.shop/api
https://enthusiasimtitleow.shop/api
https://worryfillvolcawoi.shop/api
https://cleartotalfisherwo.shop/api
Extracted
xworm
5.0
yvkd2SMAV9DOHGWC
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/H3wFXmEi
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
pastebin_url
https://pastebin.com/raw/H3wFXmEi
Signatures
-
Detect Xworm Payload 4 IoCs
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Xworm
Xworm is a remote access trojan written in C#.
-
Executes dropped EXE 4 IoCs
-
Uses the VBS compiler for execution 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm-5.6-main.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\XWorm-5.6-main\XwormLoader.exe"C:\Users\Admin\Downloads\XWorm-5.6-main\XwormLoader.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\XWorm-5.6-main\XwormLoader.exe"C:\Users\Admin\Downloads\XWorm-5.6-main\XwormLoader.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\XWorm-5.6-main\Xworm V5.6.exe"C:\Users\Admin\Downloads\XWorm-5.6-main\Xworm V5.6.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\22ljobjg\22ljobjg.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES92DB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6F74B7C373274D5398645398A6D935F0.TMP"3⤵
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000478 0x00000000000004E01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\XClient.exe"C:\Users\Admin\Downloads\XClient.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD52a68ee1810da9c5c05342fb6f00b1f4e
SHA19288df8b41a6c9a8cb527e8c9e971d2038637e75
SHA256041e7bf832700c49fef2f3bf4c313d8366fbd5d9c83ac59cbfdcc6ed201224e8
SHA5121cf06feb7ddb7839666481ec3a4b2d2e53074d9db35ab65be7893f21e5d70c3e0ebbc71092129cb58f070fa0eeb0cb9f521138b722c2dcab838e9420fd6119bc
-
Filesize
292B
MD524d8f03857511500eaaf2fa4454fe55c
SHA123a39c86a6bc07917d78c7643bbb563c383013a8
SHA25669b16f76209b420909326ee5f928700a18e8ae9122e0f2aa3fda115219042091
SHA512680c8030eb973849190f5da12392c74d52c85e7fe58ebb70977522fd15fe511f90e813ca84afffd823614bed3f91830d3fbbe75fa3c204bad4872af1ad6892de
-
Filesize
1KB
MD5b59a49a82cc7002e59862097c7372271
SHA156822688f577e1d3bac5a6365eca497d7c1750ac
SHA256e56214b7a6777c5a3b10ece1fdb898e5792b01248ea4fb85e6b7bdb68cedbf0a
SHA512e305fee192af31d66de32a31a17785b84b22b741d0e3a70358b0ecd1016f25b0d59cec65aac97f53c78764f3c61c73b42ab11fad593a17f0823da64842425980
-
Filesize
1KB
MD5d40c58bd46211e4ffcbfbdfac7c2bb69
SHA1c5cf88224acc284a4e81bd612369f0e39f3ac604
SHA25601902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca
SHA51248b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68
-
Filesize
45KB
MD5f8478ed8d0b4b0cd636d42d3ba1ef285
SHA18b488a4a848159b88d28fb036c72464c1095b8bc
SHA256a075c5c5ade48629d850c1a7056c7235e60b78ff8d55ec8542107f25402333d1
SHA5120e57f403b3bc1d493dda604ea7c3174d999c5f955fdf0ab506252eb1af1ca5acc023f9d7c8774c4aa78f5162d114542789228a96a86a2be6e49041a7ce562adf
-
Filesize
86KB
MD55238eeb72bcdad662a3dd426a898a92c
SHA10734295464c81855f773705607fe9d8be687570d
SHA256ec516d714988265cb0dfdd435ff9e28cc07a51a0698c14bb2fbbec5247ca8521
SHA512aee7f0d7557176113c284ae6e0c37481cceca598dde4a0ba6812a54a530cb232185b930443822d04263b82dc2030682c95edf7e45c6a4e6e5a5413ed98655068
-
Filesize
1.2MB
MD58ef41798df108ce9bd41382c9721b1c9
SHA11e6227635a12039f4d380531b032bf773f0e6de0
SHA256bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
SHA5124c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
-
Filesize
1.9MB
MD5bcc0fe2b28edd2da651388f84599059b
SHA144d7756708aafa08730ca9dbdc01091790940a4f
SHA256c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
SHA5123bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
-
Filesize
361KB
MD5e3143e8c70427a56dac73a808cba0c79
SHA163556c7ad9e778d5bd9092f834b5cc751e419d16
SHA256b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
SHA51274e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
-
Filesize
1.4MB
MD59043d712208178c33ba8e942834ce457
SHA1e0fa5c730bf127a33348f5d2a5673260ae3719d1
SHA256b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
SHA512dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
-
Filesize
238KB
MD5ad3b4fae17bcabc254df49f5e76b87a6
SHA11683ff029eebaffdc7a4827827da7bb361c8747e
SHA256e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
SHA5123d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
-
Filesize
14.9MB
MD556ccb739926a725e78a7acf9af52c4bb
SHA15b01b90137871c3c8f0d04f510c4d56b23932cbc
SHA25690f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
SHA5122fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
-
Filesize
183B
MD566f09a3993dcae94acfe39d45b553f58
SHA19d09f8e22d464f7021d7f713269b8169aed98682
SHA2567ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7
SHA512c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed
-
Filesize
490KB
MD59c9245810bad661af3d6efec543d34fd
SHA193e4f301156d120a87fe2c4be3aaa28b9dfd1a8d
SHA256f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478
SHA51290d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767
-
Filesize
112KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
44KB
-
Filesize
1.4MB
-
Filesize
52KB
-
Filesize
280KB
-
Filesize
36KB
-
Filesize
280KB
-
Filesize
14.9MB
-
Filesize
120KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB