Overview
overview
10Static
static
10The-MALWAR...2aed41
windows10-ltsc 2021-x64
3The-MALWAR...b54692
windows10-ltsc 2021-x64
3The-MALWAR...00f6c1
windows10-ltsc 2021-x64
3The-MALWAR...ka.exe
windows10-ltsc 2021-x64
7The-MALWAR...te.apk
windows10-ltsc 2021-x64
3The-MALWAR...en.apk
windows10-ltsc 2021-x64
3The-MALWAR...4a.apk
windows10-ltsc 2021-x64
3The-MALWAR...if.exe
windows10-ltsc 2021-x64
10The-MALWAR...il.exe
windows10-ltsc 2021-x64
8The-MALWAR...at.exe
windows10-ltsc 2021-x64
3The-MALWAR...an.exe
windows10-ltsc 2021-x64
The-MALWAR...sa.doc
windows10-ltsc 2021-x64
1The-MALWAR...er.com
windows10-ltsc 2021-x64
The-MALWAR...98.exe
windows10-ltsc 2021-x64
3The-MALWAR...aj.exe
windows10-ltsc 2021-x64
7The-MALWAR...jB.exe
windows10-ltsc 2021-x64
7The-MALWAR...om.exe
windows10-ltsc 2021-x64
6The-MALWAR...1C.exe
windows10-ltsc 2021-x64
5The-MALWAR...90.exe
windows10-ltsc 2021-x64
9The-MALWAR...6a.exe
windows10-ltsc 2021-x64
9The-MALWAR...it.exe
windows10-ltsc 2021-x64
3The-MALWAR...ng.exe
windows10-ltsc 2021-x64
7The-MALWAR....a.exe
windows10-ltsc 2021-x64
10The-MALWAR...il.vbs
windows10-ltsc 2021-x64
10The-MALWAR...1A.exe
windows10-ltsc 2021-x64
8The-MALWAR...as.exe
windows10-ltsc 2021-x64
6The-MALWAR...te.exe
windows10-ltsc 2021-x64
7The-MALWAR....a.exe
windows10-ltsc 2021-x64
3The-MALWAR...le.exe
windows10-ltsc 2021-x64
3The-MALWAR...us.exe
windows10-ltsc 2021-x64
10The-MALWAR...er.exe
windows10-ltsc 2021-x64
7The-MALWAR...ff.exe
windows10-ltsc 2021-x64
3Analysis
-
max time kernel
1792s -
max time network
1807s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
13-12-2024 18:01
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Trojan/XCSSETMacMalware/TrojanSpy.MacOS.XCSSET.A.6fa938770e83ef2e177e8adf4a2ea3d2d5b26107c30f9d85c3d1a557db2aed41
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Trojan/XCSSETMacMalware/TrojanSpy.MacOS.XCSSET.A.ac3467a04eeb552d92651af1187bdc795100ea77a7a1ac755b4681c654b54692
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Trojan/XCSSETMacMalware/TrojanSpy.MacOS.XCSSET.A.d11a549e6bc913c78673f4e142e577f372311404766be8a3153792de9f00f6c1
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Trojan/Zika.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Trojan/elite.apk
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Trojan/mobelejen.apk
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Trojan/vi4a.apk
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Virus/Floxif/Floxif.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Virus/Gnil/Gnil.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Virus/Mabezat/Mabezat.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Virus/MadMan.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Virus/Melissa.doc
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Virus/Walker.com
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Virus/WinNuke.98.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Virus/Xpaj/xpaj.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Virus/Xpaj/xpajB.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Worm/Bezilom.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Worm/Blaster/607B60AD512C50B7D71DCCC057E85F1C.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Worm/Blaster/8676210e6246948201aa014db471de90.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Worm/Blaster/8a17f336f86e81f04d8e66fa23f9b36a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Worm/Blaster/DComExploit.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Worm/Bumerang.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Worm/Fagot.a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Worm/HeadTail.vbs
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Worm/Heap41A.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Worm/Mantas.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Worm/NadIote/Nadlote.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Worm/Netres.a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Worm/Nople.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Worm/Vobfus/Vobus.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/rogues/AdwereCleaner.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/rogues/SpySheriff.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
General
-
Target
The-MALWARE-Repo-master/Virus/Xpaj/xpaj.exe
-
Size
219KB
-
MD5
d5c12fcfeebbe63f74026601cd7f39b2
-
SHA1
50281de9abb1bec1b6a1f13ccd3ce3493dee8850
-
SHA256
9db7ef2d1495dba921f3084b05d95e418a16f4c5e8de93738abef2479ad5b0da
-
SHA512
132d8c08f40a578c1dc6ac029bf2a61535087ce949ff84dbec8577505c4462358a1d9ef6cd3f58078fdcae5261d7a87348a701c28ce2357f17ecc2bc9da15b4e
-
SSDEEP
6144:Gqmg/v4y/MqGs38KHF1SubUriPOKAJnP:jmgXxXGNKHC
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: xpaj.exe File opened (read-only) \??\g: xpaj.exe File opened (read-only) \??\i: xpaj.exe File opened (read-only) \??\j: xpaj.exe File opened (read-only) \??\n: xpaj.exe File opened (read-only) \??\q: xpaj.exe File opened (read-only) \??\k: xpaj.exe File opened (read-only) \??\p: xpaj.exe File opened (read-only) \??\r: xpaj.exe File opened (read-only) \??\u: xpaj.exe File opened (read-only) \??\h: xpaj.exe File opened (read-only) \??\m: xpaj.exe File opened (read-only) \??\s: xpaj.exe File opened (read-only) \??\t: xpaj.exe File opened (read-only) \??\v: xpaj.exe File opened (read-only) \??\x: xpaj.exe File opened (read-only) \??\y: xpaj.exe File opened (read-only) \??\l: xpaj.exe File opened (read-only) \??\o: xpaj.exe File opened (read-only) \??\w: xpaj.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 xpaj.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_zh-CN.dll xpaj.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll xpaj.exe File opened for modification \??\c:\Program Files (x86)\Common Files\System\wab32res.dll xpaj.exe File opened for modification C:\Program Files (x86)\Internet Explorer\hmmapi.dll xpaj.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\mojo_core.dll xpaj.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll xpaj.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll xpaj.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libskiptags_plugin.dll xpaj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL xpaj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll xpaj.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll xpaj.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll xpaj.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\mlib_image.dll xpaj.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll xpaj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll xpaj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll xpaj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.dll xpaj.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll xpaj.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ktab.exe xpaj.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll xpaj.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdasql.dll xpaj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL xpaj.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnssci.dll xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll xpaj.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\osclientcerts.dll xpaj.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll xpaj.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe xpaj.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll xpaj.exe File opened for modification \??\c:\Program Files\Windows Photo Viewer\PhotoBase.dll xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll xpaj.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe xpaj.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pencht.dll xpaj.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll xpaj.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\WMPMediaSharing.dll xpaj.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll xpaj.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll xpaj.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\libGLESv2.dll xpaj.exe File opened for modification C:\Program Files (x86)\Common Files\System\wab32.dll xpaj.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.CoreProviders.dll xpaj.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll xpaj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE xpaj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE xpaj.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\oneauth.dll xpaj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll xpaj.exe File opened for modification \??\c:\Program Files (x86)\Internet Explorer\ielowutil.exe xpaj.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VGX\VGX.dll xpaj.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_az.dll xpaj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll xpaj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\CoolType.dll xpaj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SEQCHK10.DLL xpaj.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll xpaj.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\setup_wm.exe xpaj.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll xpaj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll xpaj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Onix32.dll xpaj.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll xpaj.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpaj.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1096 xpaj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Virus\Xpaj\xpaj.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Virus\Xpaj\xpaj.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1096
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1