Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://cdn.discordapp.com/attachments/1303767638547234836/1304123529780002876/Start.bat?ex=672e3f2e&is=672cedae&hm=1a70960a938e07e2ddd8c72ff48adfc54297eacf01b0a8578112be7228913ce2&

  • Sample

    241107-t9pc2awcrc

Score
10/10
xwormdiscoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

here-thinking.gl.at.ply.gg:50161

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    WindowsSecurity.exe

Targets

    • Target

      https://cdn.discordapp.com/attachments/1303767638547234836/1304123529780002876/Start.bat?ex=672e3f2e&is=672cedae&hm=1a70960a938e07e2ddd8c72ff48adfc54297eacf01b0a8578112be7228913ce2&

    Score
    10/10
    xwormdiscoveryexecutionpersistencerattrojan

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks