xworm | d5e04f673bbe88fe9592392cea03a3212f1f2204d12468126d11e63319422343

Analysis

max time kernel
91s
max time network
202s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05-11-2024 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

38KB
MD5

064adc1ac0842c1a8853c73cff06d1de
SHA1

ba39fd621bd15c85d7e126c3a8d1a82c528e40c1
SHA256

d5e04f673bbe88fe9592392cea03a3212f1f2204d12468126d11e63319422343
SHA512

32d721342056349bcb3203a5407d936eee2bf9a0c50ac271fbc19753bfd47cd2cde827d5de1c8c7bac88481911afd42890b47fabacd28e6dd7c43cb228934568
SSDEEP

768:zlhOEwjbrttFxUFNNixYD8YRRoNbTepFj9jae6SOMhULk/:zPybrwf2kRoNbTqFj9+e6SOMqY

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

java-either.gl.at.ply.gg:50133

Mutex

ajPUYvc7uZ6Tonau

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3188-1-0x0000000000120000-0x0000000000130000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	test.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2400	MiniSearchHost.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
71a6b59e08e25451e52675c842fae23c

SHA1
565a97673954a9209c7a05fba20b89d10b88025f

SHA256
5b96212d3d1347b76c8c1c64b2f7ef981242bedd3b84b766b543d56dbbf8dbd6

SHA512
5cc98eb2aa02e2e69165170451d89dd880893e6b07440bb84fbab6cf92cb558bd58c2235d8d64ff43d380c5e9869827800d310ee67950bb21b498d89fbb5aab3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
ef4d9165f280b4d556f349f896b81ce9

SHA1
ddfe1709a292d9900687d4fe0b4c8b2429d848a3

SHA256
8add12630f4210146f1c0f543e34f61810eadbb6759b6eb3a6303337155c9cb2

SHA512
e8b2c08605f8c3c9eaf0a8f905e65829ea2ff4e0d45c79f171ff685e80fc74e4f7858b4975fac8ebfd4dc3b21a14fe571e446889d4022400e84d8193053152ac

Download Submit
memory/3188-0-0x00007FFDF3333000-0x00007FFDF3335000-memory.dmp

Filesize
8KB

Download
memory/3188-1-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/3188-2-0x00007FFDF3333000-0x00007FFDF3335000-memory.dmp

Filesize
8KB

Download
memory/3188-3-0x00007FFDF3330000-0x00007FFDF3DF2000-memory.dmp

Filesize
10.8MB

Download
memory/3188-4-0x00007FFDF3330000-0x00007FFDF3DF2000-memory.dmp

Filesize
10.8MB

Download