ee0b405b3e166fa9c1062ac6bed228b4ca7f990ce2dc62305d15ae4b3e6e35f1

Analysis

max time kernel
721s
max time network
728s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-02-2025 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RES/XWorm.TBotNotify.resources
Size

100KB
MD5

b219d1ee4ae25f781e5bc88165839987
SHA1

bcb30240b697493fd238c0d611081200a0abc3a0
SHA256

6ec33992edc80f131e4a9f7f89fe9c9dba233f7c3bda8ce6e06711021e8645fb
SHA512

e4d013c746ca857a135484d908fd2fca6257236b8b3cba8bc10209fdbb5f7cb3b595da15618f4713eb5cdeb7033772f72c22eb9ef5022c337d1dc3ebba67c746
SSDEEP

384:r0vwtokwswq6uTq4fffjfff+7f75ArrqWKwA+apJ:dfffjfff+7f78rqWnapJ

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3024	2432	cmd.exe	30
PID 2432 wrote to memory of 3024	2432	cmd.exe	30
PID 2432 wrote to memory of 3024	2432	cmd.exe	30
PID 3024 wrote to memory of 2852	3024	rundll32.exe	31
PID 3024 wrote to memory of 2852	3024	rundll32.exe	31
PID 3024 wrote to memory of 2852	3024	rundll32.exe	31
PID 3024 wrote to memory of 2852	3024	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RES\XWorm.TBotNotify.resources
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RES\XWorm.TBotNotify.resources
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RES\XWorm.TBotNotify.resources"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4e334a7562769902012042b957973f27

SHA1
2218701d13f9df213b97363e54bd63dbbdf2f1fe

SHA256
770ba6a78eaf23a3f405c4bf885951d66a2b0accfe5c7f90d984e560627a3bb3

SHA512
5aeea8ec24d082fcd51bdce1e44eb3dd72c3e158d33478acd54ad697d4e2c0d524c8dbdc173044776cfd3d9623541fc6f099f2912442e74965f254e63dc9142f

Download Submit