463eb31b863993ffc7ebd1e67a593c0fc01bfcef367a988191926facfb93d93a | Triage

Submit
Reports

Overview

overview

Static

static

XWorm.rar

windows7-x64

1

XWorm.rar

windows10-2004-x64

ComponentF...it.dll

windows7-x64

1

ComponentF...it.dll

windows10-2004-x64

1

ComponentF...it.pdb

windows7-x64

3

ComponentF...it.pdb

windows10-2004-x64

3

D3DX9_43.dll

windows7-x64

1

D3DX9_43.dll

windows10-2004-x64

1

Krypton.Toolkit.dll

windows7-x64

1

Krypton.Toolkit.dll

windows10-2004-x64

1

Mono.Cecil.dll

windows7-x64

1

Mono.Cecil.dll

windows10-2004-x64

1

Mono.Nat.dll

windows7-x64

1

Mono.Nat.dll

windows10-2004-x64

1

VMProtectSDK64.lib

windows7-x64

3

VMProtectSDK64.lib

windows10-2004-x64

3

Vestris.Re...ib.dll

windows7-x64

1

Vestris.Re...ib.dll

windows10-2004-x64

1

XWorm.xml

windows7-x64

3

XWorm.xml

windows10-2004-x64

1

XWorm.exe

windows7-x64

XWorm.exe

windows10-2004-x64

imgui.ini

windows7-x64

1

imgui.ini

windows10-2004-x64

1

Analysis

max time kernel
96s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 22:26

Sharing

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

XWorm.rar

Resource

win7-20241023-en

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral2

Sample

XWorm.rar

Resource

win10v2004-20241007-en

rhadamanthys discovery stealer

windows10-2004-x64

12 signatures

300 seconds

Behavioral task

behavioral3

Sample

ComponentFactory.Krypton.Toolkit.dll

Resource

win7-20241023-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral4

Sample

ComponentFactory.Krypton.Toolkit.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral5

Sample

ComponentFactory.Krypton.Toolkit.pdb

Resource

win7-20240903-en

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral6

Sample

ComponentFactory.Krypton.Toolkit.pdb

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral7

Sample

D3DX9_43.dll

Resource

win7-20240729-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral8

Sample

D3DX9_43.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral9

Sample

Krypton.Toolkit.dll

Resource

win7-20241023-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral10

Sample

Krypton.Toolkit.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral11

Sample

Mono.Cecil.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral12

Sample

Mono.Cecil.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral13

Sample

Mono.Nat.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral14

Sample

Mono.Nat.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral15

Sample

VMProtectSDK64.lib

Resource

win7-20240903-en

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral16

Sample

VMProtectSDK64.lib

Resource

win10v2004-20241007-en

windows10-2004-x64

3 signatures

300 seconds

Behavioral task

behavioral17

Sample

Vestris.ResourceLib.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral18

Sample

Vestris.ResourceLib.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral19

Sample

XWorm.xml

Resource

win7-20240903-en

windows7-x64

5 signatures

300 seconds

Behavioral task

behavioral20

Sample

XWorm.xml

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

300 seconds

Behavioral task

behavioral21

Sample

XWorm.exe

Resource

win7-20240903-en

rhadamanthys discovery stealer

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral22

Sample

XWorm.exe

Resource

win10v2004-20241007-en

rhadamanthys discovery stealer

windows10-2004-x64

7 signatures

300 seconds

Behavioral task

behavioral23

Sample

imgui.ini

Resource

win7-20241010-en

windows7-x64

1 signatures

300 seconds

Behavioral task

behavioral24

Sample

imgui.ini

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

300 seconds

Report Analysis Logs

General

Target

XWorm.xml
Size

161B
MD5

c16b0746faa39818049fe38709a82c62
SHA1

3fa322fe6ed724b1bc4fd52795428a36b7b8c131
SHA256

d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad
SHA512

cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c

Score

1^/10

Malware Config

Signatures

Processes

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\XWorm.xml"
1⤵
PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x00007FFFB0270000-0x00007FFFB0280000-memory.dmp

Filesize
64KB

Download
memory/3044-1-0x00007FFFF028D000-0x00007FFFF028E000-memory.dmp

Filesize
4KB

Download
memory/3044-2-0x00007FFFF01F0000-0x00007FFFF03E5000-memory.dmp

Filesize
2.0MB

Download
memory/3044-3-0x00007FFFF01F0000-0x00007FFFF03E5000-memory.dmp

Filesize
2.0MB

Download

© 2018-2025

Terms | Privacy