Overview

overview

10

Static

static

3

Xworm V5.6.exe

windows7-x64

10

Xworm V5.6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2025 15:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Xworm V5.6.exe

  • Size

    7.7MB

  • MD5

    027ad6a104d074597068c1781cc0c90d

  • SHA1

    b489c6f4d29db588ecfc65df7ea92d6c23de4a20

  • SHA256

    238bd89de11cbe6b00e7bf57f13863394bed494b73d09570011f27b87270b51a

  • SHA512

    0e3beecff23c8d426d859758b5c9aa4490e5d47ea69e4301c73fe499bd6535ec8dfe22dae552c8e14203d78768cd2ccfb70f78e876de2ba4b2532cf502b40e4f

  • SSDEEP

    196608:xKLCFU/jHq/puROyhxeyOC7+oiRkbtejBe5:xmq/pkOYxehohbt

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:18194

soon-logical.gl.at.ply.gg:18194
Mutex

APoxCrOmNOvTLB4L

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    chrome.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 63 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 62 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1784
      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4872
        • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
          "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4148
          • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
            "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:960
            • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
              "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
              6⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:1548
              • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                7⤵
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:3508
                • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                  8⤵
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:4136
                  • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                    9⤵
                    • Checks computer location settings
                    • Suspicious use of WriteProcessMemory
                    PID:2428
                    • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                      10⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:4776
                      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                        11⤵
                        • Checks computer location settings
                        • Suspicious use of WriteProcessMemory
                        PID:3136
                        • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                          "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                          12⤵
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:4292
                          • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                            "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                            13⤵
                            • Checks computer location settings
                            • Suspicious use of WriteProcessMemory
                            PID:832
                            • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                              "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                              14⤵
                              • Checks computer location settings
                              • Suspicious use of WriteProcessMemory
                              PID:1500
                              • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                15⤵
                                • Checks computer location settings
                                PID:2224
                                • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                  16⤵
                                  • Checks computer location settings
                                  PID:2180
                                  • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                    17⤵
                                    • Checks computer location settings
                                    PID:1668
                                    • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                      18⤵
                                      • Checks computer location settings
                                      PID:4564
                                      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                        19⤵
                                        • Checks computer location settings
                                        PID:1824
                                        • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                          20⤵
                                          • Checks computer location settings
                                          PID:2092
                                          • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                            21⤵
                                            • Checks computer location settings
                                            PID:1396
                                            • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                              22⤵
                                              • Checks computer location settings
                                              PID:4088
                                              • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                23⤵
                                                • Checks computer location settings
                                                PID:2824
                                                • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  PID:2164
                                                  • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    PID:4720
                                                    • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      PID:1268
                                                      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        PID:920
                                                        • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                          28⤵
                                                          • Checks computer location settings
                                                          PID:1032
                                                          • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                            29⤵
                                                            • Checks computer location settings
                                                            PID:4864
                                                            • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                              30⤵
                                                              • Checks computer location settings
                                                              PID:1244
                                                              • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                31⤵
                                                                • Checks computer location settings
                                                                PID:4956
                                                                • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  PID:4136
                                                                  • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    PID:4476
                                                                    • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      PID:4516
                                                                      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                        35⤵
                                                                        • Checks computer location settings
                                                                        PID:3716
                                                                        • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                          36⤵
                                                                          • Checks computer location settings
                                                                          PID:1224
                                                                          • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                            37⤵
                                                                            • Checks computer location settings
                                                                            PID:1284
                                                                            • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                              38⤵
                                                                              • Checks computer location settings
                                                                              PID:5112
                                                                              • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                39⤵
                                                                                • Checks computer location settings
                                                                                PID:2864
                                                                                • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                  40⤵
                                                                                  • Checks computer location settings
                                                                                  PID:544
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                    41⤵
                                                                                    • Checks computer location settings
                                                                                    PID:2372
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                      42⤵
                                                                                      • Checks computer location settings
                                                                                      PID:1656
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                        43⤵
                                                                                        • Checks computer location settings
                                                                                        PID:3972
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                          44⤵
                                                                                          • Checks computer location settings
                                                                                          PID:4488
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            PID:632
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                              46⤵
                                                                                              • Checks computer location settings
                                                                                              PID:4448
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                47⤵
                                                                                                • Checks computer location settings
                                                                                                PID:1884
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                  48⤵
                                                                                                  • Checks computer location settings
                                                                                                  PID:1396
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                    49⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:4708
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                      50⤵
                                                                                                      • Checks computer location settings
                                                                                                      PID:4108
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                        51⤵
                                                                                                        • Checks computer location settings
                                                                                                        PID:5020
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                          52⤵
                                                                                                          • Checks computer location settings
                                                                                                          PID:2724
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                            53⤵
                                                                                                            • Checks computer location settings
                                                                                                            PID:3308
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                              54⤵
                                                                                                              • Checks computer location settings
                                                                                                              PID:1608
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                                55⤵
                                                                                                                • Checks computer location settings
                                                                                                                PID:4312
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                                  56⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  PID:4896
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                                    57⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    PID:2200
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                                      58⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:4084
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                                        59⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        PID:4564
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                                          60⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          PID:3588
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                                            61⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:1380
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                                              62⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              PID:864
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
                                                                                                                                63⤵
                                                                                                                                  PID:1396
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:2132
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                62⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:4652
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2736
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                            60⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:2344
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                          59⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4412
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                        58⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2320
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                      57⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:3952
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                    56⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:3988
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                  55⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2628
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                54⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2124
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                              53⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4316
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                            52⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:5096
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                          51⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2360
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                        50⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:3684
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                      49⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2804
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                    48⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:5004
                                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                  47⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3452
                                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                46⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:464
                                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                              45⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2880
                                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                            44⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4848
                                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                          43⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2076
                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                        42⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1572
                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                      41⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3840
                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                    40⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2128
                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                  39⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4344
                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                38⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4464
                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                              37⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:4820
                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                            36⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4872
                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                          35⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1424
                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                        34⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1764
                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4664
                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                    32⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2112
                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1360
                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                30⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3856
                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1672
                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                            28⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:960
                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3372
                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                        26⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1648
                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3308
                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                    24⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1472
                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2504
                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                22⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3056
                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3872
                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1764
                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3100
                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2112
                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4488
                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4452
                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                  15⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1948
                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                14⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1608
                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                              13⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3544
                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                            12⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:872
                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                          11⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2708
                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                        10⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4160
                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:756
                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4952
                • C:\Users\Admin\AppData\Local\Temp\start.exe
                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:632
              • C:\Users\Admin\AppData\Local\Temp\start.exe
                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4724
            • C:\Users\Admin\AppData\Local\Temp\start.exe
              "C:\Users\Admin\AppData\Local\Temp\start.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3856
          • C:\Users\Admin\AppData\Local\Temp\start.exe
            "C:\Users\Admin\AppData\Local\Temp\start.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1544
        • C:\Users\Admin\AppData\Local\Temp\start.exe
          "C:\Users\Admin\AppData\Local\Temp\start.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3876
      • C:\Users\Admin\AppData\Local\Temp\start.exe
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        2⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\start.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2972
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'start.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\chrome.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4164
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'chrome.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2212

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Xworm V5.6.exe.log
      Filesize

      654B

      MD5

      2ff39f6c7249774be85fd60a8f9a245e

      SHA1

      684ff36b31aedc1e587c8496c02722c6698c1c4e

      SHA256

      e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

      SHA512

      1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      77d622bb1a5b250869a3238b9bc1402b

      SHA1

      d47f4003c2554b9dfc4c16f22460b331886b191b

      SHA256

      f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

      SHA512

      d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      dd1d0b083fedf44b482a028fb70b96e8

      SHA1

      dc9c027937c9f6d52268a1504cbae42a39c8d36a

      SHA256

      cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c

      SHA512

      96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      71f0e090d65b6fefff8889d5819e2b41

      SHA1

      88c8d0b5e28cce1741072a55d2ef8263733fde63

      SHA256

      4a06b1ccf7ebbdd4e83a7df9d851fd42bccf25ed2c54a43039cd4d797ad7cd1d

      SHA512

      62357a39111a6f41f694f23ea12f69ba62ec3cf865680527a5631cb3a3bc7ba19ce7ad1a493af5001fe44bb7a2bfa5b7feaa5d9b5882ed3c33b5dcf93572d3f0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sxmahlsp.0ib.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\start.exe
      Filesize

      39KB

      MD5

      51e4348a35c9b40b0136fa204442f9c2

      SHA1

      aea47a3a717ca9cce49966093def7d8f5a53709a

      SHA256

      a8047efe920772b13508683a7d80de379b0cf2dc40b39a9cd37f949de6a90479

      SHA512

      f15353f1b29ead57efe865935ef0cbd9efa2f0e81e47a92993279a59ea4174fde1e9bb2546c35deda6cfa641cfa0ecd58f8a2f6006f0589ce95553d7debfa3bd

      Download Submit

    • memory/1784-22-0x00007FF982040000-0x00007FF982B01000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1784-19-0x00007FF982040000-0x00007FF982B01000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1784-15-0x00007FF982040000-0x00007FF982B01000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2092-0-0x00007FF982043000-0x00007FF982045000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2092-17-0x00007FF982040000-0x00007FF982B01000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2092-2-0x00007FF982040000-0x00007FF982B01000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2092-1-0x00000000004F0000-0x0000000000CA6000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2196-18-0x0000000000580000-0x0000000000590000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2196-16-0x00007FF982040000-0x00007FF982B01000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2196-75-0x00007FF982040000-0x00007FF982B01000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2196-78-0x00007FF982040000-0x00007FF982B01000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2196-83-0x00007FF982040000-0x00007FF982B01000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2972-28-0x0000024068220000-0x0000024068242000-memory.dmp

      Filesize

      136KB

      Download