xworm | 11af9ee8c345dd8c529ac2ec08ac51129531edb0cfd1fa5a580a36c642502163

Analysis

max time kernel
30s
max time network
15s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09-11-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loaded GUI SUPER X GODDOM.exe
Size

15.8MB
MD5

122c870b4666083d8672bc45c79db494
SHA1

c8a1b264e6178bb4cf52d022238899036e94574e
SHA256

11af9ee8c345dd8c529ac2ec08ac51129531edb0cfd1fa5a580a36c642502163
SHA512

23a0c79a6507c001d4d656d44a7784715d28e6c5c9716923e9f384b7875f53501fbab397014c3686486689ea33168773bf69af30c3c01fe7f931a65d29da2833
SSDEEP

393216:MNBDE4WXRLTfyXE/rEmkNInlv8K/HSTYwEX9mr4BGk/2uXj:MNJE4Yr+E/rR19xOYwFI+

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

client-toilet.gl.at.ply.gg:29921

Mutex

NvsfH1XO1syyGREn

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00280000000450cb-21.dat	family_xworm
behavioral1/memory/1004-36-0x0000000000890000-0x00000000008A6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	Loaded GUI SUPER X GODDOM.exe

Executes dropped EXE 2 IoCs

pid	Process
4416	Loaded GUI.exe
1004	BLACKGODDOM V.2 GOD BY LA.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	BLACKGODDOM V.2 GOD BY LA.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4416	228	Loaded GUI SUPER X GODDOM.exe	82
PID 228 wrote to memory of 4416	228	Loaded GUI SUPER X GODDOM.exe	82
PID 228 wrote to memory of 1004	228	Loaded GUI SUPER X GODDOM.exe	83
PID 228 wrote to memory of 1004	228	Loaded GUI SUPER X GODDOM.exe	83

C:\Users\Admin\AppData\Local\Temp\Loaded GUI SUPER X GODDOM.exe
"C:\Users\Admin\AppData\Local\Temp\Loaded GUI SUPER X GODDOM.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\Loaded GUI.exe
  "C:\Users\Admin\AppData\Local\Temp\Loaded GUI.exe"
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Users\Admin\AppData\Local\Temp\BLACKGODDOM V.2 GOD BY LA.exe
  "C:\Users\Admin\AppData\Local\Temp\BLACKGODDOM V.2 GOD BY LA.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BLACKGODDOM V.2 GOD BY LA.exe

Filesize
67KB

MD5
2b1bcff698482a45a0d01356ad3e0384

SHA1
77d106b1495b869600cdfda6afeaec0f75a78634

SHA256
a9bd5014b5a6744b0a5c180a3e76ff546a514dcbad8bf2d8c500f903a285424b

SHA512
e8b6a729f3b4fc02886aeed232511dc9407a52aae40f01cd2817f8369944b14240bd3edfd573dbdef0d506557f02622148ce4042f6f497c20f1f11af85eeac77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Loaded GUI.exe

Filesize
15.9MB

MD5
329f5cfa031ecf0b5eb30624277e6321

SHA1
189067b40d2b6b6f0a2e9b3bb509acc01131b15a

SHA256
0139146555814ed3ef16e36fb839dd4265cc5cb033a4500f43ef20b48a506675

SHA512
f97b6de859076d7ed76e497064c75647ca481377e043dc4172ed0c7d37870efaaf776fffb13b71d5f62b2feb6b6daddaff52b9a1ceb4f50f38ff4c0c72561a22

Download Submit
memory/228-33-0x00007FFCF4240000-0x00007FFCF4D02000-memory.dmp

Filesize
10.8MB

Download
memory/228-2-0x00007FFCF4240000-0x00007FFCF4D02000-memory.dmp

Filesize
10.8MB

Download
memory/228-1-0x0000000000BE0000-0x0000000001BBA000-memory.dmp

Filesize
15.9MB

Download
memory/228-0-0x00007FFCF4243000-0x00007FFCF4245000-memory.dmp

Filesize
8KB

Download
memory/1004-36-0x0000000000890000-0x00000000008A6000-memory.dmp

Filesize
88KB

Download
memory/1004-34-0x00007FFCF4240000-0x00007FFCF4D02000-memory.dmp

Filesize
10.8MB

Download
memory/1004-37-0x00007FFCF4240000-0x00007FFCF4D02000-memory.dmp

Filesize
10.8MB

Download
memory/1004-38-0x00007FFCF4240000-0x00007FFCF4D02000-memory.dmp

Filesize
10.8MB

Download
memory/4416-28-0x00007FFCF4240000-0x00007FFCF4D02000-memory.dmp

Filesize
10.8MB

Download
memory/4416-35-0x0000027BD00A0000-0x0000027BD1096000-memory.dmp

Filesize
16.0MB

Download
memory/4416-39-0x00007FFCF4240000-0x00007FFCF4D02000-memory.dmp

Filesize
10.8MB

Download