xworm | 1470a3336049aa3867b95b23f2671b64eebf2c79fbde95e860c6f592da96d0f7

Analysis

max time kernel
1797s
max time network
1800s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03-12-2024 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rat-virus-DONT-INSTALL-main/remota access trojan.exe
Size

169KB
MD5

ca2667182ed67e8256e9a084c29f17b0
SHA1

0c0e38a58ae8cb33af4d99748cc87a38b74ee864
SHA256

0d6f8259f225d360a0a3d2470973faea74f776e75663b36e9eceb6edc0b1fa92
SHA512

53616632672de1497f9b50b761677458369b2934c6d16372f978e695c6b9a9d248a663466c38b888451114f2553232c89059d0ecd854803da17f492af62922e5
SSDEEP

3072:sqaFZ9jFOjCA2ewhLapuvpAsZOyMqmyBeYVYf:sbZ9t/GWGwqqm1

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

saw-proceedings.gl.at.ply.gg:16297

Mutex

sr2CYoJagZJqSlDE

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
behavioral11/memory/3716-1-0x0000000000550000-0x0000000000580000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

remota access trojan.exe

description	pid	Process
Token: SeDebugPrivilege	3716	remota access trojan.exe

C:\Users\Admin\AppData\Local\Temp\rat-virus-DONT-INSTALL-main\remota access trojan.exe
"C:\Users\Admin\AppData\Local\Temp\rat-virus-DONT-INSTALL-main\remota access trojan.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-0-0x00007FFDF6C53000-0x00007FFDF6C55000-memory.dmp

Filesize
8KB

Download
memory/3716-1-0x0000000000550000-0x0000000000580000-memory.dmp

Filesize
192KB

Download
memory/3716-3-0x00007FFDF6C50000-0x00007FFDF7712000-memory.dmp

Filesize
10.8MB

Download
memory/3716-4-0x00007FFDF6C53000-0x00007FFDF6C55000-memory.dmp

Filesize
8KB

Download
memory/3716-5-0x00007FFDF6C50000-0x00007FFDF7712000-memory.dmp

Filesize
10.8MB

Download