General
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/d00mt3l/XWorm-5.6
Resource
win10v2004-20241007-en
23 signatures
900 seconds
Behavioral task
behavioral2
Sample
https://github.com/d00mt3l/XWorm-5.6
Resource
win10ltsc2021-20241211-en
11 signatures
900 seconds
Behavioral task
behavioral3
Sample
https://github.com/d00mt3l/XWorm-5.6
Resource
win11-20241007-en
11 signatures
900 seconds
Malware Config
Extracted
Family
lumma
C2
https://pillowbrocccolipe.shop/api
https://communicationgenerwo.shop/api
https://diskretainvigorousiw.shop/api
https://affordcharmcropwo.shop/api
https://dismissalcylinderhostw.shop/api
https://enthusiasimtitleow.shop/api
https://worryfillvolcawoi.shop/api
https://cleartotalfisherwo.shop/api
Extracted
Family
xworm
Version
5.0
C2
127.0.0.1:7000
Mutex
DabfWf982AgYFBlh
Attributes
-
install_file
USB.exe
aes.plain
Targets
-
-
Detect Xworm Payload
-
Lumma family
-
Xworm family
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-
Legitimate hosting services abused for malware hosting/C2
-