Overview

overview

10

Static

static

3

Rc7fork.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250217-en
  • resource tags

    arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/03/2025, 22:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Rc7fork.exe

  • Size

    155KB

  • MD5

    89cdea23fcf69912e06646f51cfdc2a5

  • SHA1

    a3236b8ef58ea89cd98c01d0e3f1ac4bc350c5bb

  • SHA256

    a3ec5b6f6fa4b9aa52045c78d2796ece4824284c356b32d3214ce8a1226c9267

  • SHA512

    1bc40fc961fbe4909ab2eff3165529228d39e8c9f89699509bf2b5b60380daf8361103bd7967a8bb9843178e05ba6ee68a3a82adf5520e2cb9403125230b94f9

  • SSDEEP

    3072:/uoFqLtXnpZ9v87jzEfo4rswbj/yjgf6yFOBvqsfzOIFc:1FspT87jz7D6qm6ysBvqsrj

Score
10/10
xwormpersistencerattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • install_file

    Antivirus.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 37 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3404
    • C:\Users\Admin\AppData\Local\Temp\Rc7fork.exe
      "C:\Users\Admin\AppData\Local\Temp\Rc7fork.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:6088
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Explorer" /tr "C:\Users\Admin\AppData\Roaming\Explorer.EXE"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4196
  • C:\Users\Admin\AppData\Roaming\Explorer.EXE
    C:\Users\Admin\AppData\Roaming\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Modifies registry class
    PID:1128
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:324
  • C:\Users\Admin\AppData\Roaming\Explorer.EXE
    C:\Users\Admin\AppData\Roaming\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Modifies registry class
    PID:4536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Explorer.EXE
    Filesize

    4.8MB

    MD5

    4f543bf58bbf481126a556fc8d642415

    SHA1

    53fa292e148d65227910bac9be1ad498d17fabf9

    SHA256

    49af13fcadea3f3b5807f11df9d2636da4033f6a4ec294940fef671336c88ce7

    SHA512

    c273e54478c3a85c4aab3498af6b5abed9001bd87062ee3a83349e731be11af31482dd541d44af8275d96d45017ab67bfe48d2fcfd57583f493c0477d04a3627

    Download Submit

  • memory/3404-10-0x00007FFE3DDF0000-0x00007FFE3E8B2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3404-2-0x0000000002AF0000-0x0000000002B05000-memory.dmp

    Filesize

    84KB

    Download

  • memory/3404-3-0x00007FFE3DDF3000-0x00007FFE3DDF5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3404-4-0x0000000003F40000-0x0000000003F54000-memory.dmp

    Filesize

    80KB

    Download

  • memory/3404-5-0x00007FFE3DDF0000-0x00007FFE3E8B2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3404-8-0x0000000004280000-0x0000000004292000-memory.dmp

    Filesize

    72KB

    Download

  • memory/3404-9-0x00007FFE3DDF3000-0x00007FFE3DDF5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3404-11-0x00007FFE3DDF0000-0x00007FFE3E8B2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3404-12-0x00007FFE3DDF0000-0x00007FFE3E8B2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/6088-7-0x00007FFE3DDF3000-0x00007FFE3DDF5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/6088-0-0x00007FFE3DDF3000-0x00007FFE3DDF5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/6088-1-0x00000000001E0000-0x000000000020C000-memory.dmp

    Filesize

    176KB

    Download