Analysis
-
max time kernel
1050s -
max time network
450s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
22-10-2024 21:26
General
-
Target
XWorm-5.6-main.zip
-
Size
24.8MB
-
MD5
98af17dc86622b292d58fbba45d51309
-
SHA1
44a7d9423ce00ddda8000f9d18e3fe5693b5776f
-
SHA256
eed75f0edf37bdd0d0a64ac8723672dbfe64288fb3845b89cc3596d0511f67d1
-
SHA512
b3b9c67e373bcba5bd039088953400a3296b374f29f5de00f56c0702da7f9eccf0c452586d486c17ab1ea5ab16240112fda8457ec258d2ba9735b17959db4b05
-
SSDEEP
786432:3vngbHGYI0DuXXEDgfI+tjIdubuu0SVww6vZqwffr:fgbHGY2hfI8yuxV7oswXr
Malware Config
Extracted
xworm
5.0
127.0.0.1:8888
CqFxvlSKmx4pDotr
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Executes dropped EXE 1 IoCs
-
Uses the VBS compiler for execution 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm-5.6-main.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Xworm V5.6.exe"C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Xworm V5.6.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1xwn2hwx\1xwn2hwx.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES58A1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc61698F47924F47088E4A91466DF188.TMP"3⤵
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5b48ce0e5772e5f20c5a7233f8e7e7c19
SHA107c5a889e5a2f119df73e444210d2061aa3f940a
SHA25660998214046f12794b0e5a05aa269661288c8592303b6a0f9a680cbbf20b5e40
SHA5120afc8e4379ba7a932d1aaac1295860a70bc2101500c643ac006ad42cfb8675dba1646642f822c00cad7d99ee292fe497823645f4b48ab6cd3a9e7316b29e540e
-
Filesize
322B
MD5ea91d7f7e1e1fb46edd2b13ce12e9ee3
SHA17010723d27cbe69af805f1ccd118b5b205836243
SHA256f4d8da65c8e6d0f1a6a250238402720de7f5e9ab12501a3a2a41d6812fa9e30b
SHA512e380df942421f42eeaaffbef51f6a3fb55c1f118bbc0556daa9efc0c16770787c63934189adcd75f2b625b83c0c24998d57ec9e275cf64035d2c6b595c1c69a0
-
Filesize
2KB
MD5131759ce8ee220f7a2cb33ef9a8b79a9
SHA1482238fbb1e78d9e878cd6efad707a3b81ddbbb1
SHA25670d23926f78a61030fd13e77ecd0652bfada60b62e08a44c8490404f9b8c8dc6
SHA5126c96444ed30a72894df0412feefbd5500b3e73e9f9b6562a110800bbe5d1fbfae5223cfc8ed062f6ff0238238ca7f58daaa020730d66bdf8d850f13750b3a269
-
Filesize
1KB
MD5fd28b2dd9052684b349d5a35993f5a1d
SHA1d5bf166dd21770ef6a85befa10433164320fdf67
SHA256109f9f5937ac894e93b9534042bca10612a7d46d98a70dcdfe39329163e2deac
SHA512386858809d965bc53da268a2f3348e6c8e821cb3ac66d88fa86b0033bb58ecda4f9c574dcb90f70ae7517fadf4655e90cbf91d7b09caeed550ae4d8e18075b9e
-
Filesize
1.2MB
MD58ef41798df108ce9bd41382c9721b1c9
SHA11e6227635a12039f4d380531b032bf773f0e6de0
SHA256bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
SHA5124c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
-
Filesize
1.9MB
MD5bcc0fe2b28edd2da651388f84599059b
SHA144d7756708aafa08730ca9dbdc01091790940a4f
SHA256c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
SHA5123bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
-
Filesize
10KB
MD5640d8ffa779c6dd5252a262e440c66c0
SHA13252d8a70a18d5d4e0cc84791d587dd12a394c2a
SHA256440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
SHA512e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
-
Filesize
97KB
MD54f409511e9f93f175cd18187379e94cb
SHA1598893866d60cd3a070279cc80fda49ee8c06c9b
SHA256115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
SHA5120d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
-
Filesize
115KB
MD5ad1740cb3317527aa1acae6e7440311e
SHA17a0f8669ed1950db65632b01c489ed4d9aba434e
SHA2567a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
SHA512eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
-
Filesize
9KB
MD51c2cea154deedc5a39daec2f1dadf991
SHA16b130d79f314fa9e4015758dea5f331bbe1e8997
SHA2563b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
SHA512dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
-
Filesize
9KB
MD54ea9ab789f5ae96766e3f64c8a4e2480
SHA1423cb762ce81fab3b2b4c9066fe6ea197d691770
SHA25684b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
SHA512f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
-
Filesize
361KB
MD5e3143e8c70427a56dac73a808cba0c79
SHA163556c7ad9e778d5bd9092f834b5cc751e419d16
SHA256b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
SHA51274e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
-
Filesize
97KB
MD514465d8d0f4688a4366c3bf163ba0a17
SHA19f1fa68a285db742e4834f7d670cae415ce6b3b6
SHA2563f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
SHA51201db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
-
Filesize
112KB
MD5f1463f4e1a6ef6cc6e290d46830d2da1
SHA1bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf
SHA256142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec
SHA5120fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2
-
Filesize
131KB
MD5a512719efc9e6ecc5e2375abceb1669a
SHA151fae98edfab7cd6b6baac6df5ecbda082eeb1db
SHA256b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574
SHA512e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625
-
Filesize
125KB
MD59c053bef57c4a7b575a0726af0e26dae
SHA147148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c
SHA2565bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41
SHA512482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a
-
Filesize
100KB
MD59dbdd6972e129d31568661a89c81d8f9
SHA1747399af62062598120214cef29761c367cfd28a
SHA25645c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484
SHA512e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d
-
Filesize
106KB
MD5d7c9666d30936e29ce156a2e04807863
SHA1845e805d55156372232e0110e5dc80380e2cb1e5
SHA2566ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
SHA5123cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
-
Filesize
164KB
MD57891c91d1761dc8a8846d362e6e31869
SHA10229bb01b7b4a0fca305eb521ec5dfbaa53674ea
SHA25629d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8
SHA512ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7
-
Filesize
108KB
MD5af1739a9b1a1bf72e7072ad9551c6eea
SHA18da0a34c3a8040c4b7c67d7143c853c71b3d208d
SHA256a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab
SHA512eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120
-
Filesize
264KB
MD53e24e40b41ecc59750c9231d8f8da40b
SHA191a701cf25aea2984f75846b6c83865d668ccad6
SHA256bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
SHA512fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
-
Filesize
1.4MB
MD59043d712208178c33ba8e942834ce457
SHA1e0fa5c730bf127a33348f5d2a5673260ae3719d1
SHA256b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
SHA512dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
-
Filesize
238KB
MD5ad3b4fae17bcabc254df49f5e76b87a6
SHA11683ff029eebaffdc7a4827827da7bb361c8747e
SHA256e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
SHA5123d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
-
Filesize
43KB
MD5e5e97bdcdd8c87ad68fbe65053fdabb7
SHA198f5e3a352e06934fc9bac38216bbe95315d87a1
SHA256e8ad135c26c54b5835700daf66f6a9e8a6e1a77c179b0aa9a89ef9708a1a0ab5
SHA512ab18c502510c41dc9235b4719df2509c065308e03ef913034454400f92a5f2191d974ce357adfbf861ffcb1e9ef0a8ee2940eb67016d88a5d3c3f2acf77c544f
-
Filesize
14.9MB
MD556ccb739926a725e78a7acf9af52c4bb
SHA15b01b90137871c3c8f0d04f510c4d56b23932cbc
SHA25690f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
SHA5122fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
-
Filesize
183B
MD566f09a3993dcae94acfe39d45b553f58
SHA19d09f8e22d464f7021d7f713269b8169aed98682
SHA2567ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7
SHA512c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
32KB
-
Filesize
1.7MB
-
Filesize
10.8MB
-
Filesize
1.4MB
-
Filesize
1.7MB
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
14.9MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
8KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB