Overview

overview

10

Static

static

10

XWorm V5.6 PAID.7z

windows10-ltsc 2021-x64

1

XWorm V5.6 PAID.7z

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm V5.6 PAID.7z

  • Size

    29.0MB

  • Sample

    250204-t4dz4stpdj

  • MD5

    0ea984ec2d550a4205fabd911f973a6c

  • SHA1

    71307409e69eb60fe612315e09d4109f91cf23c9

  • SHA256

    6b7c8ac18f492b4536307f4680cd40a9990bafc716d451575ba46c124c3f07b9

  • SHA512

    7bdb043850bbc32d41872b4090426e2193582b139e8be25972b25b9f9fe3a1c54e089a5738a78a804211031a010b8e9a6bd8d983cb534fb34d4a0f87e9484eba

  • SSDEEP

    786432:WqVzpgbD+4aZ/INeMVKyBMtD2Op14tMIADxrHLfygiw:dgbD+XtFMVKyGUuI4ZHLfyK

Score
10/10
stormkittyxwormagilenetdefense_evasiondiscoveryransomwarerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

v1pmXhMionQszKjj

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target

      XWorm V5.6 PAID.7z

    • Size

      29.0MB

    • MD5

      0ea984ec2d550a4205fabd911f973a6c

    • SHA1

      71307409e69eb60fe612315e09d4109f91cf23c9

    • SHA256

      6b7c8ac18f492b4536307f4680cd40a9990bafc716d451575ba46c124c3f07b9

    • SHA512

      7bdb043850bbc32d41872b4090426e2193582b139e8be25972b25b9f9fe3a1c54e089a5738a78a804211031a010b8e9a6bd8d983cb534fb34d4a0f87e9484eba

    • SSDEEP

      786432:WqVzpgbD+4aZ/INeMVKyBMtD2Op14tMIADxrHLfygiw:dgbD+XtFMVKyGUuI4ZHLfyK

    Score
    10/10
    xwormagilenetdefense_evasiondiscoveryransomwarerattrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detect Xworm Payload

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • UAC bypass

      defense_evasiontrojan

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Uses the VBS compiler for execution

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

4
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Tasks