Overview

overview

10

Static

static

3

Winlocker ....6.exe

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    25s
  • max time network
    26s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    25-01-2025 00:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Winlocker Builder v0.6.exe

  • Size

    1.3MB

  • MD5

    4f768716267ee42c40f6cb0578bae261

  • SHA1

    e143ab8ad439e224232bac5d0edc7f2051cbdc13

  • SHA256

    86bcea956a17faa66f5354fe890fae5fc41d2156b28ec1030d58aa9c51e32299

  • SHA512

    5f51a734c6eef7a9aba22e78c8dece02bff2adee06f8551f2f7fd57b77a6f2a22c39f46930bcf1f62c116725ef0fd5e56d7da7a893210a35c2f2721949de0a27

  • SSDEEP

    24576:DbXvsRLDInc+3WNyc4aKZQ6VvDrVq3EXcWdFVtV6d/PHk:U0c+Gr1YBrNXcEFVf6pPH

Score
10/10
xwormdefense_evasiondiscoveryexecutionrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

vTtlhGPfn0ebMPsq

Attributes
  • Install_directory

    %Public%

  • install_file

    explorer.exe

  • pastebin_url

    https://pastebin.com/raw/4zaiEtZS

  • telegram

    https://api.telegram.org/bot8175192176:AAHZuZ0-rHS66YSwsvh8-gQjbZYSbY3IyXo/sendMessage?chat_id=7537927256

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    defense_evasion
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 40 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Winlocker Builder v0.6.exe
    "C:\Users\Admin\AppData\Local\Temp\Winlocker Builder v0.6.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:708
    • C:\Windows\System32\control.exe
      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.cpl",
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:332
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\svchost.cpl",
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Checks computer location settings
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:704
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\System32\svchost.cpl"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2684
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /F /TN "svchost" /SC ONLOGON /TR "mshta.exe vbscript:Execute(\"on error resume next:CreateObject(\"\"Wscript.Shell\"\").Run \"\"\"\"\"\"C:\Windows\System32\svchost.lnk\"\"\"\"\"\",0:close\"")"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1544
        • C:\Windows\system32\SCHTASKS.exe
          SCHTASKS.exe /RUN /TN "svchost"
          4⤵
            PID:2920
      • C:\Users\Admin\AppData\Local\Temp\Winlocker Builder .exe
        "C:\Users\Admin\AppData\Local\Temp\Winlocker Builder .exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3376
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7FBF.tmp\Builder #6.bat" "
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2700
          • C:\Users\Admin\AppData\Local\Temp\7FBF.tmp\builder.exe
            builder.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2996
    • C:\Windows\system32\mshta.exe
      "mshta.exe" vbscript:Execute("on error resume next:CreateObject(""Wscript.Shell"").Run """"""C:\Windows\System32\svchost.lnk"""""",0:close")
      1⤵
      • Modifies registry class
      PID:3720
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
      1⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\explorer.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4424
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1712
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\explorer.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1096
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1664
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Public\explorer.exe"
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1780
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:3140
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2956

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      3KB

      MD5

      3eb3833f769dd890afc295b977eab4b4

      SHA1

      e857649b037939602c72ad003e5d3698695f436f

      SHA256

      c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

      SHA512

      c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      808f797fa79f7f9b5c6849d529734680

      SHA1

      4bc234dd22f06b07d6e661d813bfc5bdf65e8b03

      SHA256

      e4f003683b47e933315e6d54e81f51fe2c4082f847982a7af338f40c3d0becb2

      SHA512

      70c6d79f484597b07e781c24a7523076f2c647af116d9e0a3e26ad1e595a0fd41ea5c005bfa045a7b3b5e606188584476a4c2318b5a6b7f72dab7d561c151692

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      6a421d6652a9f6b1582f9c462f22e6ca

      SHA1

      8ec6495259e625b6375dd76bef8f764d4ed51e46

      SHA256

      77b21cdb72126323bc4663ad474c627957e085fd3eb0976d93b343b39c7564c1

      SHA512

      0485e1999dd782b3d071215ae7d97b36928b0870728c3d081cd7133de61861184c81f727dfb9a677ba279af0aa7041d49d0b137219e3dd2041a788f25ed9d1fb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      cabc37714ec99e98ca1acb89411dc801

      SHA1

      8a5038f35c1c591681c5199b769cb6bb30f8ec63

      SHA256

      b4bd90580d87edfd2467bf567f8437f8fd810b5070c22087ca927f42d9b72bc0

      SHA512

      1db18d794df0d27c34dac3e6d8fe17744d5dad70135b71bc13242a90fced15031bcaadae3f7f9384762687747932baf2149cfbec039aab936a8edf015b49ad69

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      60b3262c3163ee3d466199160b9ed07d

      SHA1

      994ece4ea4e61de0be2fdd580f87e3415f9e1ff6

      SHA256

      e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb

      SHA512

      081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7FBF.tmp\Builder #6.bat
      Filesize

      28B

      MD5

      8051f1a637f4635ede0c96f81302993b

      SHA1

      1712fdb1a9d64edae50acc063574c1109d613546

      SHA256

      ff61e26e4d145be670bc4512afdf87210da097acaa43bf97cf278def640b3110

      SHA512

      b54aec0ff9ec591e2c8507ef4729c3b69e0263337eb52c58dd69f5b2e0b50d5d8f3bc17c32b5c55a2327809f0cd17713f511f3ab7a03bfa826e53da0d8a96c9d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7FBF.tmp\builder.exe
      Filesize

      2.4MB

      MD5

      9729d33f5cc788e9c1930bcc968acffa

      SHA1

      68c662875f7b805dd6f246919d406c8d92158073

      SHA256

      3711a334cb3c6e2a92461067f2d7db2946e9b139f1517b214bc929ba42a86aae

      SHA512

      af12beee6da79e5498eb292eb4a122667bf5dcdf840def97a5476adb31e0701a2aa0585b4266547bb4307c3524c7f9733dbf32f2a87c87b33fadb4bb1ecd0c3f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Winlocker Builder .exe
      Filesize

      1.3MB

      MD5

      4caed3373183b76693cebb8f917faa1f

      SHA1

      10d2a0c799b6231bc90d66fe59a8245e74bbbaf0

      SHA256

      a4b302ddaecc5ca50b48152644e3a101d389ed6b72abeb3c610f5f1facaf4547

      SHA512

      83670f489cb7e4be492e3361ba2291dc725ce5ce7694c5f6e9c988b680dca4147042b2ae8c0d2e78bbda5fa2d6b8c7ca83c8299bd4f1594107262ca26d276128

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dwb3dilu.4ud.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\svchost.cpl
      Filesize

      49KB

      MD5

      8fe4b2ca0b85980b73050ab7e8eb58a8

      SHA1

      d78af51db795dd51ffe48f96321d7a3fdd853117

      SHA256

      16160a0f94f668219b4b69aa3c396aef00388c305e66a887f7a891fb460bc914

      SHA512

      6d73f190d657b9f04887d7d88ef8aa913e61b3eb8de50de4607f035a32fde9f9bb2f76a9918d73039ca294a56d98e2a7de7f233ff5b43079a5d80bbf7b2392f1

      Download Submit

    • C:\Windows\System32\svchost.lnk
      Filesize

      104B

      MD5

      62658c068ffbf0e44a72ac7ad1d0de8c

      SHA1

      be24daae430936518ccafa73d53e64ca3f29f4b1

      SHA256

      b87ace89fe7d8861eaa93dde044ba1b74d7fb29b84ec945e5ec681511fe3096a

      SHA512

      0e56c57ebeaba882ce2b1290f053b2d95367b2809306b31cd7b0fbe7f47c7f656818f8a49311c8bccaa67c8f0b16d6c3d25119289adbfb27b275eb780e8dd036

      Download Submit

    • memory/704-32-0x0000000000D40000-0x0000000000D54000-memory.dmp

      Filesize

      80KB

      Download

    • memory/704-33-0x000000006D010000-0x000000006D024000-memory.dmp

      Filesize

      80KB

      Download

    • memory/704-62-0x000002E05B360000-0x000002E05B888000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/708-27-0x00007FFF4A240000-0x00007FFF4AD02000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/708-0-0x00007FFF4A243000-0x00007FFF4A245000-memory.dmp

      Filesize

      8KB

      Download

    • memory/708-13-0x00007FFF4A240000-0x00007FFF4AD02000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/708-1-0x0000000000BE0000-0x0000000000D3A000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/2684-46-0x00000295C25C0000-0x00000295C25E2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2956-84-0x000001CA7B6F0000-0x000001CA7B6F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-82-0x000001CA7B6F0000-0x000001CA7B6F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-87-0x000001CA7B6F0000-0x000001CA7B6F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-86-0x000001CA7B6F0000-0x000001CA7B6F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-85-0x000001CA7B6F0000-0x000001CA7B6F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-75-0x000001CA7B6F0000-0x000001CA7B6F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-83-0x000001CA7B6F0000-0x000001CA7B6F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-76-0x000001CA7B6F0000-0x000001CA7B6F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-81-0x000001CA7B6F0000-0x000001CA7B6F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-77-0x000001CA7B6F0000-0x000001CA7B6F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2996-133-0x0000000000400000-0x0000000000671000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2996-139-0x0000000000400000-0x0000000000671000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/3376-57-0x0000000000400000-0x000000000067E000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/3376-25-0x0000000000400000-0x000000000067E000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/3380-74-0x0000000008600000-0x0000000008612000-memory.dmp

      Filesize

      72KB

      Download

    • memory/3380-73-0x000000006D010000-0x000000006D024000-memory.dmp

      Filesize

      80KB

      Download