Overview

overview

10

Static

static

10

XWorm.rar

windows7-x64

1

XWorm.rar

windows10-2004-x64

10

ComponentF...it.dll

windows7-x64

1

ComponentF...it.dll

windows10-2004-x64

1

ComponentF...it.pdb

windows7-x64

3

ComponentF...it.pdb

windows10-2004-x64

3

D3DX9_43.dll

windows7-x64

1

D3DX9_43.dll

windows10-2004-x64

1

Krypton.Toolkit.dll

windows7-x64

1

Krypton.Toolkit.dll

windows10-2004-x64

1

Mono.Cecil.dll

windows7-x64

1

Mono.Cecil.dll

windows10-2004-x64

1

Mono.Nat.dll

windows7-x64

1

Mono.Nat.dll

windows10-2004-x64

1

VMProtectSDK64.lib

windows7-x64

3

VMProtectSDK64.lib

windows10-2004-x64

3

Vestris.Re...ib.dll

windows7-x64

1

Vestris.Re...ib.dll

windows10-2004-x64

1

XWorm.xml

windows7-x64

3

XWorm.xml

windows10-2004-x64

1

XWorm.exe

windows7-x64

10

XWorm.exe

windows10-2004-x64

10

imgui.ini

windows7-x64

1

imgui.ini

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    277s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-12-2024 22:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XWorm.rar

  • Size

    3.8MB

  • MD5

    72ed99d6168329b94021eaf282af0552

  • SHA1

    0be0ad479efa7b5d3021b06ab5f6b71f858ba08f

  • SHA256

    463eb31b863993ffc7ebd1e67a593c0fc01bfcef367a988191926facfb93d93a

  • SHA512

    b11c5657389e8e6f5af5bdbef2b22daef62e26484117c9a30de184a63980e6108cd804e43db7494f24057eaeec32ced7ab5ebd6f7aedb6467a207a209a2bd2a7

  • SSDEEP

    98304:AdRaDzmLW/nQDItjvhd8cMOBmYS1svAJFFa6XmeuwSqUjGMtokcqh:AAearjJd8vNYNQFzEvBVtoFqh

Score
10/10
rhadamanthysdiscoverystealer

Malware Config

Extracted

Family

rhadamanthys

C2

https://195.3.223.126:4287/9d0dc091285eb9fbf2e/o8f3c8oj.8rdif

Signatures

  • Detect rhadamanthys stealer shellcode 8 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Rhadamanthys family
    rhadamanthys
  • Executes dropped EXE 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm.rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2300
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1452
    • C:\Users\Admin\Desktop\New folder\XWorm.exe
      "C:\Users\Admin\Desktop\New folder\XWorm.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4124
    • C:\Users\Admin\Desktop\New folder\XWorm.exe
      "C:\Users\Admin\Desktop\New folder\XWorm.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1460
    • C:\Users\Admin\Desktop\New folder\XWorm.exe
      "C:\Users\Admin\Desktop\New folder\XWorm.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2532
    • C:\Users\Admin\Desktop\New folder\XWorm.exe
      "C:\Users\Admin\Desktop\New folder\XWorm.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1948
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1468
    • C:\Users\Admin\Desktop\New folder\XWorm.exe
      "C:\Users\Admin\Desktop\New folder\XWorm.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2828

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\New folder\XWorm.exe
      Filesize

      456KB

      MD5

      515a0c8be21a5ba836e5687fc2d73333

      SHA1

      c52be9d0d37ac1b8d6bc09860e68e9e0615255ab

      SHA256

      9950788284df125c7359aeb91435ed24d59359fac6a74ed73774ca31561cc7ae

      SHA512

      4e2bd7ce844bba25aff12e2607c4281b59f7579b9407139ef6136ef09282c7afac1c702adebc42f8bd7703fac047fd8b5add34df334bfc04d3518ea483225522

      Download Submit

    • memory/1460-32-0x0000000002170000-0x0000000002570000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1468-50-0x000001B1D2CC0000-0x000001B1D2CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1468-52-0x000001B1D2CC0000-0x000001B1D2CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1468-47-0x000001B1D2CC0000-0x000001B1D2CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1468-48-0x000001B1D2CC0000-0x000001B1D2CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1468-49-0x000001B1D2CC0000-0x000001B1D2CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1468-51-0x000001B1D2CC0000-0x000001B1D2CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1468-43-0x000001B1D2CC0000-0x000001B1D2CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1468-42-0x000001B1D2CC0000-0x000001B1D2CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1468-41-0x000001B1D2CC0000-0x000001B1D2CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1468-53-0x000001B1D2CC0000-0x000001B1D2CC1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1948-40-0x0000000002310000-0x0000000002710000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2532-36-0x00000000021B0000-0x00000000025B0000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2828-57-0x0000000002390000-0x0000000002790000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/4124-26-0x00000000023C0000-0x00000000027C0000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/4124-24-0x0000000000650000-0x0000000000657000-memory.dmp

      Filesize

      28KB

      Download

    • memory/4124-25-0x00000000023C0000-0x00000000027C0000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/4124-28-0x00000000023C0000-0x00000000027C0000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/4124-27-0x00000000023C0000-0x00000000027C0000-memory.dmp

      Filesize

      4.0MB

      Download