Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 18:01
General
-
Target
XWorm V5.6/XwormLoader.exe
-
Size
576KB
-
MD5
f1a4c690564f491ad4f7fc8ce79e2fc3
-
SHA1
cc16274baae2af0c614566d56b693774fe892168
-
SHA256
0a3555b2ab1f76066c496eb43ebc520c82824a22cfcb714a75c5edc1ad99d88a
-
SHA512
f7a1116b889493c079000847f5517e9149d5dce703b85b1520ad1d4810c575500aab47460a6e0d7e266fa5ef70ba10d4b625587725251734404913844897e180
-
SSDEEP
12288:bwl4OwitTdBZpKfSTUNe/RhCEIX7RIiZmWJyGpfxd8KR0F7Br1dfPDWUw+b5/xgo:bwDdtTdBZISTACRhCE+Gi1yG
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious use of AdjustPrivilegeToken 38 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\XwormLoader.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\XwormLoader.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\Xworm V5.6.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3fc 0x4081⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\Xworm V5.6.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52d2a235f1b0f4b608c5910673735494b
SHA123a63f6529bfdf917886ab8347092238db0423a0
SHA256c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
SHA51210684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086
-
Filesize
799KB
MD55c79d44ff8563412dce1bb36626781d6
SHA1a13da89b3ec6becd64e1a5aa2780bde27b4bc467
SHA256ecea21c9c2bd359747693dc3d34db8338547fdae7f06739336daa3d826a85135
SHA51225e594e2526e76307f67ebec73bb3c8d96fc4a4b170d8fdffead41b798a00ede67e0fbe3e3d99b54ce424c356a10a262312149d84d76c8248464b135c7cd3d18
-
Filesize
14.9MB
-
Filesize
2.0MB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
696KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
24KB
-
Filesize
616KB