Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03/03/2025, 00:30
General
-
Target
Rexon-Paid_Executor.exe
-
Size
1.9MB
-
MD5
767e47b7200526d6d7b9f82d7d350523
-
SHA1
7c3c57726639fd44cab7a0014e5cad278386cb6f
-
SHA256
463d3278d31d58a43d7ee5716fc7040ca7f454778ff82595ae67e416a7219b0d
-
SHA512
a467c77065293aca2c6bebc3c84c6b5584bd808cf7c8fe53794f02224a401eaebac7b7255ae1ef7081bc17b57abd1116e47a51b87b0f02bc41668f702da139f4
-
SSDEEP
49152:ZCCiwOpZt1fyR59Z48fjQs9vlaEaBf6xxCWFWV/:gHjpAfrQw9i6xIWFc/
Malware Config
Extracted
xworm
5.0
display-equivalent.gl.at.ply.gg:12744
SkjG4THxcPjCb6Fx
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rexon-Paid_Executor.exe"C:\Users\Admin\AppData\Local\Temp\Rexon-Paid_Executor.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Rexon-Paid_Executor.exe"C:\Users\Admin\AppData\Roaming\Rexon-Paid_Executor.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\BAZINGA.mp4"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD508a7079e32a92cc7daf474bfdfa5fe93
SHA1f001555edb196d52cfe8b15f8b02beb98fd85c26
SHA2565cf8689e1f429a23c74937fefb19e64e24870d37cd9856c2207b5dc9ee574fbd
SHA5128115c8957427c479daf7f2a6ff97512c31bc781f7dc264acb58c976945f16cb854e1540e93483c4e3512b0a61fdcaa8ee67933820f04e549fb17ec1dcd86b091
-
Filesize
47KB
MD51142855d6cfd0deb6799a776fd04074f
SHA15206e413c09808dcfd996c7e1f570827f596b0d2
SHA256e38aa74da26c6d44a18639403ebe1d5a5ccf1aa4afd165983d8ee78861abb5d4
SHA5123640fbacdfed60e29ef21d8fea56db5dab82eafec9d0dcdcd500c77c448b4a9f46ddbc0047681d6048bd7446dd481284a922755b1251e0cf17533094b2e8cd0e
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
992KB
-
Filesize
208KB
-
Filesize
96KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
2.7MB
-
Filesize
68KB
-
Filesize
412KB
-
Filesize
92KB
-
Filesize
348KB
-
Filesize
1.5MB
-
Filesize
68KB
-
Filesize
496KB
-
Filesize
16.7MB
-
Filesize
192KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
132KB
-
Filesize
260KB
-
Filesize
2.0MB
-
Filesize
392KB
-
Filesize
80KB
-
Filesize
320KB
-
Filesize
84KB
-
Filesize
76KB
-
Filesize
436KB
-
Filesize
2.7MB
-
Filesize
84KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
76KB
-
Filesize
140KB
-
Filesize
264KB
-
Filesize
788KB
-
Filesize
88KB
-
Filesize
68KB
-
Filesize
188KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
308KB
-
Filesize
264KB
-
Filesize
1.5MB
-
Filesize
68KB
-
Filesize
388KB
-
Filesize
284KB
-
Filesize
72KB
-
Filesize
24.4MB
-
Filesize
464KB
-
Filesize
68KB
-
Filesize
312KB
-
Filesize
348KB
-
Filesize
208KB
-
Filesize
2.7MB