Overview

overview

10

Static

static

3

injector.exe

windows7-x64

10

injector.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 20:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    injector.exe

  • Size

    9.7MB

  • MD5

    86a51d640ea68877541d015596110871

  • SHA1

    9ba1687ba37d28db708b9a458350b646f7f6d1ec

  • SHA256

    fde50f0142a28aa4729653fd6d20fe24444b4de78db287e6257377e617d4ffeb

  • SHA512

    78184bf183807df518449ed5a6e38c3668c645bd9fa22cc9c2adb8786e1a5eb435e43ab5c551b998947ea76f03499c599e9428d7f6ccbb72a912f356b884d8b8

  • SSDEEP

    196608:q9Fi1rHBpQ8du9iLK8KyUmydMdRqg3fDsu4/f8QeN:nhndhPPqWboi

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %Public%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/kADeGNZE

Signatures

  • Detect Xworm Payload 5 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\injector.exe
    "C:\Users\Admin\AppData\Local\Temp\injector.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Users\Admin\AppData\Local\injector.exe
      "C:\Users\Admin\AppData\Local\injector.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1660
    • C:\Users\Admin\AppData\Local\COM Surrogate.exe
      "C:\Users\Admin\AppData\Local\COM Surrogate.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\COM Surrogate.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2832
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'COM Surrogate.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2648
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2628
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1124
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2672
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {2D9662C3-275D-44AE-BBBC-18DFDF9C422A} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Users\Public\svchost.exe
      C:\Users\Public\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1940
    • C:\Users\Public\svchost.exe
      C:\Users\Public\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:280
    • C:\Users\Public\svchost.exe
      C:\Users\Public\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\COM Surrogate.exe
    Filesize

    69KB

    MD5

    533f3b108a18d4bdcb42329a42e740c6

    SHA1

    fe59ee9912580e99c127205ed59da725495dd037

    SHA256

    de7574564048511af92e161a95921b4295e013f0f9603895d2eaefb4aec005ac

    SHA512

    1936e292e6ffa20497c2944f4aa2d05e76e0a0a52cf836b24f8b1901daa8025ff95481f222ec453bacbcbad97389ffd69ab84cdcb1b4c636aecdbcead50663a2

    Download Submit

  • C:\Users\Admin\AppData\Local\injector.exe
    Filesize

    40KB

    MD5

    525f01625963a71151e81f8b20ebb31e

    SHA1

    b7930fddd0d56ddbcf5fec090e66186833521a5e

    SHA256

    0d75a2406b1485056c7371bb94ea642dd61b6dc967a27d1a8f3d065857a74d4f

    SHA512

    f8986dacf8896512f4b313de4eb2d8fa3f4a4de1aa4e59d1d161dcbd8d632f4354608826c332fc4d042c665fc64c4f6ce29cd2382d7d611ed5e8c9a67882bc91

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    93397ce06e3ddcff5388e59fc7e3c0dd

    SHA1

    36f0d11a23bca53530372ed3c7996a765cd9ae98

    SHA256

    c953b0a7b771d8ad98427a16da3ed9ca877ad9087d7e281d476a9b8c0041f63a

    SHA512

    17cefb92b4576eca688e0f5b3423195b25585c7d42c873c0ceeab8f01a806c5eefb1124ff41fa9394b01e1fe277929013c64454ab758c5a045f1b92c203956d8

    Download Submit

  • memory/280-51-0x0000000000150000-0x0000000000168000-memory.dmp

    Filesize

    96KB

    Download

  • memory/1940-47-0x00000000012B0000-0x00000000012C8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2316-53-0x0000000000DA0000-0x0000000000DB8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2452-13-0x0000000000F70000-0x0000000000F88000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2452-42-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2452-43-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2452-14-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2452-48-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2648-27-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2648-26-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2832-19-0x000000001B690000-0x000000001B972000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2832-20-0x00000000021D0000-0x00000000021D8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2992-0-0x000007FEF51C3000-0x000007FEF51C4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2992-1-0x0000000001180000-0x0000000001B3A000-memory.dmp

    Filesize

    9.7MB

    Download