xworm | d96ba77a6038e8ee3d5a03fd69affbdfe0b36ab074b92320d263da75b1b2d32a

Analysis

max time kernel
64s
max time network
66s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Impulse Spoof.exe
Size

33KB
MD5

c295fde2ff84c9adbf62426ffa094265
SHA1

e37a13c0d53726526df331d9c5013514bbe6f18b
SHA256

d96ba77a6038e8ee3d5a03fd69affbdfe0b36ab074b92320d263da75b1b2d32a
SHA512

5332daac116fc882ab6427681c2418abcfe507df6e0d1e73cf97748b3ad1a1fb46097cfaae552fcf7d5b7fbb4f87ea4c6f4e7b221b6bd83850b6f7504cad063f
SSDEEP

384:Sl8UlK/V9FoBZ9aZV0NLx7o92lKZaJZvf/95ApkFy7BLT/OZwpGmTv99Ikciszjo:aO/VMOGxwgJZvn9dFyJ9FCj4LOjhwJV

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

sep-framing.gl.at.ply.gg:61526

Mutex

Q67Vx5bQ2jgfNOaG

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2220-1-0x00000000001D0000-0x00000000001DE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Deletes itself 1 IoCs

pid	Process
1044	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2128	timeout.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	Impulse Spoof.exe
Token: SeDebugPrivilege	2220	Impulse Spoof.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1044	2220	Impulse Spoof.exe	30
PID 2220 wrote to memory of 1044	2220	Impulse Spoof.exe	30
PID 2220 wrote to memory of 1044	2220	Impulse Spoof.exe	30
PID 1044 wrote to memory of 2128	1044	cmd.exe	32
PID 1044 wrote to memory of 2128	1044	cmd.exe	32
PID 1044 wrote to memory of 2128	1044	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\Impulse Spoof.exe
"C:\Users\Admin\AppData\Local\Temp\Impulse Spoof.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpAF81.tmp.bat""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAF81.tmp.bat

Filesize
165B

MD5
908805b59da2fdb6d0a5df6ef39467e0

SHA1
ddd879fe44c93337f787099e13f79f708547de9b

SHA256
47d308bcae098c51e3701a6c745b84fc925956101cae2926d0b77d98ec2a6214

SHA512
dd74c475cc6e6cf825da39b9186181457241368c46bc8de5bd98386bc90b5da66b95f4b6281b92e6571605fbdd1caaef65c6959a51b264e571dbdd76931c4aae

Download Submit
memory/2220-0-0x000007FEF64B3000-0x000007FEF64B4000-memory.dmp

Filesize
4KB

Download
memory/2220-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/2220-2-0x000007FEF64B0000-0x000007FEF6E9C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-3-0x000007FEF64B3000-0x000007FEF64B4000-memory.dmp

Filesize
4KB

Download
memory/2220-4-0x000007FEF64B0000-0x000007FEF6E9C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-13-0x000007FEF64B0000-0x000007FEF6E9C000-memory.dmp

Filesize
9.9MB

Download