xworm | c0361ce0281736d7c36d465ba67683cc16d70335186bd179cedc8f0383760ae4

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2025, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootstrapperNeww.exe
Size

2.9MB
MD5

1b1b8584e5ef883aaa5be59076087d6b
SHA1

e2067cedc5a022487fdcd4f7407b75202d6b0eb1
SHA256

c0361ce0281736d7c36d465ba67683cc16d70335186bd179cedc8f0383760ae4
SHA512

73a951370df807595ddb61ab81aa7e5d7407fca5dba08f40e209d48e1bc2e4e4960439fa61bdf8a2967cde1865460c1df025fff6124607f6eb0752f35e382d45
SSDEEP

49152:IlcyXfHnaBTof9ePCjkIAm1skqXfd+/9A9ByClY1v/a/ehH7pNLLn2tM:CZXfHaFoCIvqkqXf0FglY1XOe97vLnh

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

casino-offline.gl.at.ply.gg:34999

Attributes

Install_directory
%AppData%
install_file
NVIDIA app.exe

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b5b-16.dat	family_xworm
behavioral2/memory/4136-25-0x00000000006D0000-0x00000000006E8000-memory.dmp	family_xworm
behavioral2/memory/2184-24-0x0000000000400000-0x00000000006F8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4788	powershell.exe
2056	powershell.exe
4092	powershell.exe
2936	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation	BootstrapperNeww.exe
Key value queried	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation	loader.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVIDIA app.lnk	loader.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVIDIA app.lnk	loader.exe

Executes dropped EXE 3 IoCs

pid	Process
2676	BootstrapperNew.exe
4136	loader.exe
2764	NVIDIA app.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NVIDIA app = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA app.exe"	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperNeww.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "180"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4788	powershell.exe
4788	powershell.exe
2056	powershell.exe
2056	powershell.exe
4092	powershell.exe
4092	powershell.exe
2936	powershell.exe
2936	powershell.exe
4136	loader.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1376	Process not Found
4588	Process not Found
1748	Process not Found
3020	Process not Found
4448	Process not Found
4720	Process not Found
668	Process not Found
4748	Process not Found
1576	Process not Found
4324	Process not Found
2056	Process not Found
2632	Process not Found
3616	Process not Found
4628	Process not Found
4884	Process not Found
4644	Process not Found
4120	Process not Found
2892	Process not Found
2732	Process not Found
1952	Process not Found
1236	Process not Found
1580	Process not Found
4840	Process not Found
2804	Process not Found
4440	Process not Found
4988	Process not Found
2512	Process not Found
4820	Process not Found
2992	Process not Found
3352	Process not Found
3344	Process not Found
656	Process not Found
4620	Process not Found
2752	Process not Found
744	Process not Found
4244	Process not Found
2932	Process not Found
4780	Process not Found
3384	Process not Found
460	Process not Found
5112	Process not Found
2608	Process not Found
1072	Process not Found
2284	Process not Found
4240	Process not Found
5028	Process not Found
4844	Process not Found
4980	Process not Found
5096	Process not Found
5004	Process not Found
212	Process not Found
1912	Process not Found
3664	Process not Found
3492	Process not Found
4572	Process not Found
3096	Process not Found
520	Process not Found
4072	Process not Found
4812	Process not Found
5036	Process not Found
3456	Process not Found
2400	Process not Found
2596	Process not Found
2376	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	loader.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	4136	loader.exe
Token: SeDebugPrivilege	2764	NVIDIA app.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4136	loader.exe
3976	LogonUI.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2676	2184	BootstrapperNeww.exe	86
PID 2184 wrote to memory of 2676	2184	BootstrapperNeww.exe	86
PID 2184 wrote to memory of 4136	2184	BootstrapperNeww.exe	88
PID 2184 wrote to memory of 4136	2184	BootstrapperNeww.exe	88
PID 4136 wrote to memory of 4788	4136	loader.exe	89
PID 4136 wrote to memory of 4788	4136	loader.exe	89
PID 4136 wrote to memory of 2056	4136	loader.exe	91
PID 4136 wrote to memory of 2056	4136	loader.exe	91
PID 4136 wrote to memory of 4092	4136	loader.exe	93
PID 4136 wrote to memory of 4092	4136	loader.exe	93
PID 4136 wrote to memory of 2936	4136	loader.exe	95
PID 4136 wrote to memory of 2936	4136	loader.exe	95
PID 4136 wrote to memory of 3692	4136	loader.exe	99
PID 4136 wrote to memory of 3692	4136	loader.exe	99
PID 4136 wrote to memory of 4520	4136	loader.exe	119
PID 4136 wrote to memory of 4520	4136	loader.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BootstrapperNeww.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNeww.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'loader.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\NVIDIA app.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NVIDIA app.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "NVIDIA app" /tr "C:\Users\Admin\AppData\Roaming\NVIDIA app.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3692
- - C:\Windows\SYSTEM32\shutdown.exe
    shutdown.exe -L
    3⤵
    PID:4520

C:\Users\Admin\AppData\Roaming\NVIDIA app.exe
"C:\Users\Admin\AppData\Roaming\NVIDIA app.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3909055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d8cb3e9459807e35f02130fad3f9860d

SHA1
5af7f32cb8a30e850892b15e9164030a041f4bd6

SHA256
2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68

SHA512
045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
69d19b4013518b842a415206333091f6

SHA1
35b3145e73757766ad9cd38c82470b42a229cc40

SHA256
5ffd870e8af0bb7b007aedf58b683cbffb01e6503fb66852707b3046a29040e3

SHA512
fdc3f22498b98c2b51334f138a8bcdd95736067c53ad84a9af17a887e0579cbcc83360280f9f2623fda2ab35368df3175ac64592cf12128b5aa158a5cff3bade

Download Submit
C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe

Filesize
2.9MB

MD5
f227cdfd423b3cc03bb69c49babf4da3

SHA1
3db5a97d9b0f2545e7ba97026af6c28512200441

SHA256
cb5d6c1ca0aa6232a2d55e14b20ac4a9945a0bd063c57d60a5ed3ae94160e3e8

SHA512
b10afd03b02a928545c16fad39a6ae46b68b1e1a2477a6990803ce80008e7161fb2ebc9380ba15a1b074bb436aa34bcd6c94a922933d438b1c22489717e1e10e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pyji4lf5.iuc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
67KB

MD5
de7e058ade5e6ebe2cce6b2fd10d4bae

SHA1
0196abbe9f3fc7db4ad524d29119f7ee9beb37db

SHA256
271c6a42cc3f42923496857ea6adf8407f73fda81faa2586fb0fe5f6901e6d5a

SHA512
3fb799fca20dfb6a2871b507bec70587c555882ab7b3af6bbca855f90b66f5172a22d5dda0f2baa9e67781b9277d30e04d9dccfddc8dea095ab75b4898d921cd

Download Submit
memory/2184-24-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2676-36-0x00000179CFC80000-0x00000179CFC96000-memory.dmp

Filesize
88KB

Download
memory/2676-92-0x00007FFE78FA3000-0x00007FFE78FA5000-memory.dmp

Filesize
8KB

Download
memory/2676-30-0x00000179CE8F0000-0x00000179CE928000-memory.dmp

Filesize
224KB

Download
memory/2676-31-0x00000179CE8B0000-0x00000179CE8BE000-memory.dmp

Filesize
56KB

Download
memory/2676-32-0x00000179CFB80000-0x00000179CFC80000-memory.dmp

Filesize
1024KB

Download
memory/2676-33-0x00000179CE8C0000-0x00000179CE8CA000-memory.dmp

Filesize
40KB

Download
memory/2676-34-0x00000179CE930000-0x00000179CE956000-memory.dmp

Filesize
152KB

Download
memory/2676-35-0x00000179CE960000-0x00000179CE968000-memory.dmp

Filesize
32KB

Download
memory/2676-101-0x00007FFE78FA0000-0x00007FFE79A61000-memory.dmp

Filesize
10.8MB

Download
memory/2676-37-0x00000179CE8E0000-0x00000179CE8EA000-memory.dmp

Filesize
40KB

Download
memory/2676-38-0x00000179CE8D0000-0x00000179CE8DA000-memory.dmp

Filesize
40KB

Download
memory/2676-39-0x00000179CFCA0000-0x00000179CFCA8000-memory.dmp

Filesize
32KB

Download
memory/2676-27-0x00000179CE710000-0x00000179CE718000-memory.dmp

Filesize
32KB

Download
memory/2676-94-0x00007FFE78FA0000-0x00007FFE79A61000-memory.dmp

Filesize
10.8MB

Download
memory/2676-26-0x00000179AF2E0000-0x00000179AF2F0000-memory.dmp

Filesize
64KB

Download
memory/2676-29-0x00007FFE78FA0000-0x00007FFE79A61000-memory.dmp

Filesize
10.8MB

Download
memory/2676-23-0x00000179AEBB0000-0x00000179AEE92000-memory.dmp

Filesize
2.9MB

Download
memory/2676-12-0x00007FFE78FA3000-0x00007FFE78FA5000-memory.dmp

Filesize
8KB

Download
memory/4136-91-0x00007FFE78FA0000-0x00007FFE79A61000-memory.dmp

Filesize
10.8MB

Download
memory/4136-25-0x00000000006D0000-0x00000000006E8000-memory.dmp

Filesize
96KB

Download
memory/4136-93-0x00007FFE78FA0000-0x00007FFE79A61000-memory.dmp

Filesize
10.8MB

Download
memory/4136-95-0x00007FFE78FA0000-0x00007FFE79A61000-memory.dmp

Filesize
10.8MB

Download
memory/4136-100-0x00007FFE78FA0000-0x00007FFE79A61000-memory.dmp

Filesize
10.8MB

Download
memory/4136-28-0x00007FFE78FA0000-0x00007FFE79A61000-memory.dmp

Filesize
10.8MB

Download
memory/4788-50-0x000002E510AC0000-0x000002E510AE2000-memory.dmp

Filesize
136KB

Download