xworm | 11af9ee8c345dd8c529ac2ec08ac51129531edb0cfd1fa5a580a36c642502163

Analysis

max time kernel
19s
max time network
25s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loaded GUI SUPER X GODDOM.exe
Size

15.8MB
MD5

122c870b4666083d8672bc45c79db494
SHA1

c8a1b264e6178bb4cf52d022238899036e94574e
SHA256

11af9ee8c345dd8c529ac2ec08ac51129531edb0cfd1fa5a580a36c642502163
SHA512

23a0c79a6507c001d4d656d44a7784715d28e6c5c9716923e9f384b7875f53501fbab397014c3686486689ea33168773bf69af30c3c01fe7f931a65d29da2833
SSDEEP

393216:MNBDE4WXRLTfyXE/rEmkNInlv8K/HSTYwEX9mr4BGk/2uXj:MNJE4Yr+E/rR19xOYwFI+

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

client-toilet.gl.at.ply.gg:29921

Mutex

NvsfH1XO1syyGREn

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0026000000018b89-14.dat	family_xworm
behavioral1/memory/2904-15-0x0000000000090000-0x00000000000A6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 3 IoCs

pid	Process
1636	Loaded GUI.exe
2904	BLACKGODDOM V.2 GOD BY LA.exe
1244	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
572	Loaded GUI SUPER X GODDOM.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	BLACKGODDOM V.2 GOD BY LA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 1636	572	Loaded GUI SUPER X GODDOM.exe	29
PID 572 wrote to memory of 1636	572	Loaded GUI SUPER X GODDOM.exe	29
PID 572 wrote to memory of 1636	572	Loaded GUI SUPER X GODDOM.exe	29
PID 572 wrote to memory of 2904	572	Loaded GUI SUPER X GODDOM.exe	30
PID 572 wrote to memory of 2904	572	Loaded GUI SUPER X GODDOM.exe	30
PID 572 wrote to memory of 2904	572	Loaded GUI SUPER X GODDOM.exe	30

C:\Users\Admin\AppData\Local\Temp\Loaded GUI SUPER X GODDOM.exe
"C:\Users\Admin\AppData\Local\Temp\Loaded GUI SUPER X GODDOM.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572
- C:\Users\Admin\AppData\Local\Temp\Loaded GUI.exe
  "C:\Users\Admin\AppData\Local\Temp\Loaded GUI.exe"
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Users\Admin\AppData\Local\Temp\BLACKGODDOM V.2 GOD BY LA.exe
  "C:\Users\Admin\AppData\Local\Temp\BLACKGODDOM V.2 GOD BY LA.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BLACKGODDOM V.2 GOD BY LA.exe

Filesize
67KB

MD5
2b1bcff698482a45a0d01356ad3e0384

SHA1
77d106b1495b869600cdfda6afeaec0f75a78634

SHA256
a9bd5014b5a6744b0a5c180a3e76ff546a514dcbad8bf2d8c500f903a285424b

SHA512
e8b6a729f3b4fc02886aeed232511dc9407a52aae40f01cd2817f8369944b14240bd3edfd573dbdef0d506557f02622148ce4042f6f497c20f1f11af85eeac77

Download Submit
\Users\Admin\AppData\Local\Temp\Loaded GUI.exe

Filesize
15.9MB

MD5
329f5cfa031ecf0b5eb30624277e6321

SHA1
189067b40d2b6b6f0a2e9b3bb509acc01131b15a

SHA256
0139146555814ed3ef16e36fb839dd4265cc5cb033a4500f43ef20b48a506675

SHA512
f97b6de859076d7ed76e497064c75647ca481377e043dc4172ed0c7d37870efaaf776fffb13b71d5f62b2feb6b6daddaff52b9a1ceb4f50f38ff4c0c72561a22

Download Submit
memory/572-0-0x000007FEF5DE3000-0x000007FEF5DE4000-memory.dmp

Filesize
4KB

Download
memory/572-1-0x0000000000E70000-0x0000000001E4A000-memory.dmp

Filesize
15.9MB

Download
memory/572-2-0x000007FEF5DE0000-0x000007FEF67CC000-memory.dmp

Filesize
9.9MB

Download
memory/572-17-0x000007FEF5DE0000-0x000007FEF67CC000-memory.dmp

Filesize
9.9MB

Download
memory/1636-12-0x000007FEF5DE0000-0x000007FEF67CC000-memory.dmp

Filesize
9.9MB

Download
memory/1636-16-0x000000013FF10000-0x0000000140F06000-memory.dmp

Filesize
16.0MB

Download
memory/1636-19-0x000007FEF5DE0000-0x000007FEF67CC000-memory.dmp

Filesize
9.9MB

Download
memory/2904-15-0x0000000000090000-0x00000000000A6000-memory.dmp

Filesize
88KB

Download