Overview

overview

10

Static

static

3

KING WEAPON.exe

windows7-x64

10

KING WEAPON.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KING WEAPON.exe

  • Size

    653KB

  • Sample

    241109-jhbbzszhrm

  • MD5

    0c873d832bcfb08d023fca6ebe0e22de

  • SHA1

    0b18147315d176ed302ce2a3af814ad630831302

  • SHA256

    ebae2bd3c854a82d65b0db827fff81940e4a5876c9a536a7612fa3bedb38480a

  • SHA512

    1309e69d1ca57643946528b7747d40b5b2ab3f9c7c29168470afb690983813f8bf981a72f4e5f5ddd81260594ef3c8e37753eea13d75905b7c7e49db049faaf8

  • SSDEEP

    12288:+Vq3hWyjefPaWZE/sNG2c64EvUOMW2UgSgaMDOH8ogiSkXsXBhOdaEoIwEb59pJB:k7yjeHcr9O+O

Score
10/10
xwormdiscoveryevasionpersistenceprivilege_escalationransomwarerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

client-toilet.gl.at.ply.gg:29921

Mutex

NvsfH1XO1syyGREn

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Targets

    • Target

      KING WEAPON.exe

    • Size

      653KB

    • MD5

      0c873d832bcfb08d023fca6ebe0e22de

    • SHA1

      0b18147315d176ed302ce2a3af814ad630831302

    • SHA256

      ebae2bd3c854a82d65b0db827fff81940e4a5876c9a536a7612fa3bedb38480a

    • SHA512

      1309e69d1ca57643946528b7747d40b5b2ab3f9c7c29168470afb690983813f8bf981a72f4e5f5ddd81260594ef3c8e37753eea13d75905b7c7e49db049faaf8

    • SSDEEP

      12288:+Vq3hWyjefPaWZE/sNG2c64EvUOMW2UgSgaMDOH8ogiSkXsXBhOdaEoIwEb59pJB:k7yjeHcr9O+O

    Score
    10/10
    xwormrattrojandiscoveryevasionpersistenceprivilege_escalationransomware

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Network Share Discovery

1
T1135

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks