Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
06/03/2025, 02:54
General
-
Target
2.exe
-
Size
32KB
-
MD5
0348827ff0672fa51903184d58dbb05a
-
SHA1
856266e755be4e749644de4b2983800d272cc64f
-
SHA256
8fb7c15f8e61e7f6016650ed44a7b736254d27eaa9ef5aeed13a60b429e1bcc1
-
SHA512
b949fc474b9bceb95308a8ca6949ddff906e48c8af7c15da229464489bd62c22a3593893569a780df1a27e9d9e6e36d8051cf8d714a50a3f92842811c027378b
-
SSDEEP
768:uVa+vNtg+PB23Tw49FzVFE9jlV7Ojhfbu:gvNtgw23U49HFE9jlV7Oj96
Malware Config
Extracted
Family
xworm
Version
5.0
C2
172.22.176.1:1177
Mutex
wF5dVYYnCjrDs5P2
Attributes
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/3124-1-0x0000000000870000-0x000000000087E000-memory.dmp family_xworm -
Xworm family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2952 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3124 2.exe Token: SeDebugPrivilege 2952 taskmgr.exe Token: SeSystemProfilePrivilege 2952 taskmgr.exe Token: SeCreateGlobalPrivilege 2952 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe 2952 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2952