Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 03:24
Behavioral task
behavioral1
Sample
XWorm V5.3.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
XWorm V5.3.exe
Resource
win10v2004-20241007-en
General
-
Target
XWorm V5.3.exe
-
Size
13.8MB
-
MD5
897201dc6254281404ab74aa27790a71
-
SHA1
9409ddf7e72b7869f4d689c88f9bbc1bc241a56e
-
SHA256
f41828bd13a3a85fdf7a1d688b21ce33d2015c3c5f46b4d92ab6ea8ea019e03a
-
SHA512
2673cd7b927ffc22f3a4b4fbfcb1b4f576c416d67168e486e6d79fdd132129c9e244e36d7b7883a4a1ed51e993cc4384bf24f2fa3129584f2bd43fd16042de20
-
SSDEEP
98304:rtktdI2TeowYNva0P6olJ93ipte/Giw56/gpeejzhAAsnQqHKrzzIRwG4saY6c2n:rGt3JwVFcV/Gp7jiwzYwENy3W
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2764 XWorm V5.3.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral1/memory/2764-1-0x0000000000910000-0x00000000016EE000-memory.dmp agile_net -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2764 XWorm V5.3.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2728 2764 XWorm V5.3.exe 31 PID 2764 wrote to memory of 2728 2764 XWorm V5.3.exe 31 PID 2764 wrote to memory of 2728 2764 XWorm V5.3.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V5.3.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.3.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2764 -s 6642⤵PID:2728
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD52f1a50031dcf5c87d92e8b2491fdcea6
SHA171e2aaa2d1bb7dbe32a00e1d01d744830ecce08f
SHA25647578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed
SHA5121c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8