Analysis
-
max time kernel
112s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 02:17
General
-
Target
2025-03-06_7c47ea730d0d9201dfb31d80c4bf16ce_hiddentear.exe
-
Size
192KB
-
MD5
7c47ea730d0d9201dfb31d80c4bf16ce
-
SHA1
85de8ad640c8b2c5e186f4bdf1819870afeac2b8
-
SHA256
a6efc36d12cb0bbeff1748eefb46f2ad6df30cc736a0afe1337f3b97e85443f2
-
SHA512
5c708b9a251263de8f2c6619f0515fd3ea3bc1b8be837b778223983cb97f182c36bd7332dbd79c701793038b805b304033a858f104d283f400b3af90bca5237d
-
SSDEEP
6144:jmpsdZuN2iRzjMelR74/gU8G9CbGCrmsE/93ffk8q98R77Hg3c05yH+lDAA:jmpsdZuN2iRzjBlR74/gU8G9CbGCrmsz
Malware Config
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-06_7c47ea730d0d9201dfb31d80c4bf16ce_hiddentear.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-06_7c47ea730d0d9201dfb31d80c4bf16ce_hiddentear.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "2025-03-06_7c47ea730d0d9201dfb31d80c4bf16ce_hiddentear" /tr "C:\Users\Admin\AppData\Roaming\2025-03-06_7c47ea730d0d9201dfb31d80c4bf16ce_hiddentear.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\2025-03-06_7c47ea730d0d9201dfb31d80c4bf16ce_hiddentear.exeC:\Users\Admin\AppData\Roaming\2025-03-06_7c47ea730d0d9201dfb31d80c4bf16ce_hiddentear.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2025-03-06_7c47ea730d0d9201dfb31d80c4bf16ce_hiddentear.exeC:\Users\Admin\AppData\Roaming\2025-03-06_7c47ea730d0d9201dfb31d80c4bf16ce_hiddentear.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fde7cc81ed0c50e7ce18702102f19ace
SHA1e9f02b348fda9b22bb3999b4ebef4d366f153086
SHA25600ac4add3fbf73f31bdeb249969dddc68da554c9e9383ec524d63c64dc3f4b53
SHA51275bf55c4f619948f16e29f51008d026e7789eda82615f566b150d54f5769b64d7fe1a6ff8be458e2630be621c551183dfe272ce0a579024065cbc2b4b26f4bf5
-
Filesize
192KB
MD57c47ea730d0d9201dfb31d80c4bf16ce
SHA185de8ad640c8b2c5e186f4bdf1819870afeac2b8
SHA256a6efc36d12cb0bbeff1748eefb46f2ad6df30cc736a0afe1337f3b97e85443f2
SHA5125c708b9a251263de8f2c6619f0515fd3ea3bc1b8be837b778223983cb97f182c36bd7332dbd79c701793038b805b304033a858f104d283f400b3af90bca5237d
-
Filesize
8KB
-
Filesize
216KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB