Analysis
-
max time kernel
20s -
max time network
13s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 02:45
General
-
Target
$R7DQTGG.exe
-
Size
197KB
-
MD5
23ae846b601cdfbc78da67bf61e265fa
-
SHA1
8104966ae762225d23df128b2cf8bde8145bbf01
-
SHA256
a67721023e1aea8b73d8614e6e29e5108152f510619516da1648dc03cb7de122
-
SHA512
7e002c88090b5468ceb186e68c5ae34ab8ab22782bbd33387d1c665dcc8770e25ae2fe7243fbd94dc5d2c277650a5d90961bef6ded616e9c6629a659494d1c36
-
SSDEEP
3072:CLq2PnaybVqQQK/Ec/OaW3JRUGKXs+S++7KFSbxeY+qDDrMI:eq2bpg8GqStKEbxI
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
x69Microsoft Edge.exe
-
pastebin_url
https://pastebin.com/raw/zYgpCQBC
-
telegram
https://api.telegram.org/bot7322335748:AAEr-qkbNoi4AH-VkGzWTsoAJ0Jx3HkKwbk/sendMessage?chat_id=7763830849
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 21 IoCs
-
Suspicious use of SendNotifyMessage 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R7DQTGG.exe"C:\Users\Admin\AppData\Local\Temp\$R7DQTGG.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
216KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB