Overview

overview

10

Static

static

3

2025-01-25...ar.exe

windows7-x64

10

2025-01-25...ar.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2025 01:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-25_10bb93eec2a765c88fb550db7148804b_hiddentear.exe

  • Size

    320KB

  • MD5

    10bb93eec2a765c88fb550db7148804b

  • SHA1

    611b67285e9a47587a0bba088c8bf5de0c5ed1ba

  • SHA256

    4aa0a2cb031cd492650016770e1483b3756211c63cda0702cbd42513d9d95b58

  • SHA512

    da1f004749606976dac9ad2fbf26e4748458ec09c2aa144a08f4b457775848199c9c4887c0c207ca9e0b52e1fa875d5ae9baeef7cb3f7be45569430306fd1f1d

  • SSDEEP

    3072:ONg5n8T+2Ir9vdk9M2VtRe685A9PM+lmsolAIrRuw+mqv9j1MWLQTXfdzA8Tq:Ohi2QWf3Rer5A90+lDAA+fdz

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

91.211.250.177:7000

Attributes
  • Install_directory

    %Temp%

  • install_file

    Ex4 To MQL.exe

  • telegram

    https://api.telegram.org/bot8007089982:AAGd-ZTUSnm0zdt-l-kH17pJMcMaCnS_VgI/sendMessage?chat_id=7832105812

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-25_10bb93eec2a765c88fb550db7148804b_hiddentear.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-25_10bb93eec2a765c88fb550db7148804b_hiddentear.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Users\Admin\AppData\Local\Temp\Ex4ToMql.exe
      "C:\Users\Admin\AppData\Local\Temp\Ex4ToMql.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:396
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ex4ToMql.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2460
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Ex4ToMql.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4188
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ex4 To MQL.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2944
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Ex4 To MQL.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4760
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Ex4 To MQL" /tr "C:\Users\Admin\AppData\Local\Temp\Ex4 To MQL.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4076
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB98C.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1500
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:3120
  • C:\Users\Admin\AppData\Local\Temp\Ex4 To MQL.exe
    "C:\Users\Admin\AppData\Local\Temp\Ex4 To MQL.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    d85ba6ff808d9e5444a4b369f5bc2730

    SHA1

    31aa9d96590fff6981b315e0b391b575e4c0804a

    SHA256

    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

    SHA512

    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    77d622bb1a5b250869a3238b9bc1402b

    SHA1

    d47f4003c2554b9dfc4c16f22460b331886b191b

    SHA256

    f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

    SHA512

    d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    b3bc9ca267ea2969eb6201d77e58560c

    SHA1

    78f83a443aa1ca235edcab2da9e2fda6fecc1da4

    SHA256

    7ea18b6f900f2c30a5c34845d62d4fe9fc1f11e40714b3dbd69592cbfb5dc695

    SHA512

    8cc70e4f88f3d9f59beec22dafdb403144f7f390250205e08279a2f8e01e783af44ae31aa4a8a7ea05865b05303ac5e5048f7fb44488be538d9701b6195e9b28

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    944B

    MD5

    0256bd284691ed0fc502ef3c8a7e58dc

    SHA1

    dcdf69dc8ca8bf068f65d20ef1563bbe283e2413

    SHA256

    e2fb83098e114084f51ed7187334f861ce670051046c39f338928296ca9a49cf

    SHA512

    c5b29c1e0a15ddb68b0579848066774fa7cdc6f35087bbbf47c05a5c0dcc1eb3e61b2ddadfbded8c1ed9820e637596a9f08a97db8fb18000d168e6b159060c42

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Ex4ToMql.exe
    Filesize

    243KB

    MD5

    4e145169529ec9046b4a2ef0c84420a0

    SHA1

    0b2ea5f7bf699bfac2f902edb1b6b1e7af16f2bd

    SHA256

    bfa09032e71647fcd224a530107c5e2b1840a6e0a6f9ed7c9915d69156cb7e79

    SHA512

    4e7046c519d6dcea6f129eb482c92262a72e8bd6776e57d4af15852a9690ad03445bc20e620bcf8fc2b5441069916dde7e44233d947924792796b3cb4238aa1e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_szq1gjnv.uhd.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpB98C.tmp.bat
    Filesize

    206B

    MD5

    de15c1cc6cadc3b06d829bedbc061571

    SHA1

    6875c18d5280ce3000f424e1d34d8c7867cedbd0

    SHA256

    daeb4cad5707155e88b1d29ca97b77b22fd190e2a980b94742997b75883dd48a

    SHA512

    7074c44a12ab09dcb5414cbe2b281823b4a62b90b96f2fc0fa9138705284913c2d1b505c0dd797bb52e191ca68831fe545279e99e0215330156ce4a7e4854d5b

    Download Submit

  • memory/396-14-0x0000000000C80000-0x0000000000CC2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/396-21-0x00007FFB29E60000-0x00007FFB2A921000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/396-22-0x00007FFB29E60000-0x00007FFB2A921000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/396-15-0x00007FFB29E60000-0x00007FFB2A921000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/396-73-0x00007FFB29E60000-0x00007FFB2A921000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2460-32-0x000001C8FF950000-0x000001C8FF972000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2636-20-0x00007FFB29E60000-0x00007FFB2A921000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2636-0-0x00007FFB29E63000-0x00007FFB29E65000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2636-2-0x00007FFB29E60000-0x00007FFB2A921000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2636-1-0x0000000000EE0000-0x0000000000F36000-memory.dmp

    Filesize

    344KB

    Download