Analysis
-
max time kernel
92s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
04/03/2025, 21:33
General
-
Target
NHCUR_BootstrapperNew.exe
-
Size
2.9MB
-
MD5
8f4833925c458ee2c6b40ef0e0b978f0
-
SHA1
f37823826806dfe3ab30f6f92ee9807ca3265332
-
SHA256
2da50060f34dbe8ae3cb42988efbe40546eba522f090958013b3e47178aa04c7
-
SHA512
88b81b3d204b6ef0234740a0795659f6a924b5106a80cac8d4d174a48003285b395598952de6c03075f15b3cf1055d86d3e604b1346eb8285f098dc71f0e4e97
-
SSDEEP
49152:8gnJGTce2a1Qo0JjdjW62omu2pCoXghq86WKAlQAd882TQaa0t/s/LAZ42Q:tE4eBOo0JjdjpJcNA9882kJbMC
Malware Config
Extracted
xworm
-
Install_directory
%port%
-
install_file
svchost.exe
-
pastebin_url
https://pastebin.com/raw/GMv8QPCE
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NHCUR_BootstrapperNew.exe"C:\Users\Admin\AppData\Local\Temp\NHCUR_BootstrapperNew.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAZgByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AdQBrACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHcAdQBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGcAegBzACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\WMI Provider Host.exe"C:\Users\Admin\AppData\Local\Temp\WMI Provider Host.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5f227cdfd423b3cc03bb69c49babf4da3
SHA13db5a97d9b0f2545e7ba97026af6c28512200441
SHA256cb5d6c1ca0aa6232a2d55e14b20ac4a9945a0bd063c57d60a5ed3ae94160e3e8
SHA512b10afd03b02a928545c16fad39a6ae46b68b1e1a2477a6990803ce80008e7161fb2ebc9380ba15a1b074bb436aa34bcd6c94a922933d438b1c22489717e1e10e
-
Filesize
57KB
MD57f4631cc67828fc55d6c8bd1af02bf44
SHA154d6e1c3e0b655d231d461e32d187c0f2338295d
SHA2565361c6e459fd49ee6a11f586c5dd3a2626f1338cdc4ce661287f48966451a6dd
SHA512f931f8bde5aa6c2d528031fd5505eb6a0044edddcd1c5798ef762102e8d59e5701087259258d5cc15fea59e1e199f2c870fa95ad748a8e20680096cc4d62c348
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
652KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
152KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
8KB
-
Filesize
1024KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
40KB
-
Filesize
224KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
8KB