xworm | 42a43122a976de6400853bcb4d91eb6fc01b33e323e9c44e9d4740c978180a8e

Analysis

max time kernel
74s
max time network
75s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2025, 13:09

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

cheatengine.exe
Size

42KB
MD5

fe3ecd7a7068b85e5c1a1c8833e1b5ac
SHA1

ebbd9a0b9f54fe308f1a40bd737deeb812f34415
SHA256

42a43122a976de6400853bcb4d91eb6fc01b33e323e9c44e9d4740c978180a8e
SHA512

87f75872aa6630d5093b2065ab6fc0f80d981ddbbddaef339d99f5a6a3e18e4313f502b300d468ac248e4ad807852c3732c554541e6d83e63165108b12e04c76
SSDEEP

768:+RPD9OQhx/BZ3Tw4xKdVFE9jffOjhBbAds4S1EAd8II1:+d9OW/Z3U4xcFE9jffOjP0dS1EAd8II1

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Idlerkik-51025.portmap.host:51025

Mutex

a1yX5464i0yhChwC

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/668-1-0x0000000000C20000-0x0000000000C30000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "223"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	668	cheatengine.exe
Token: SeShutdownPrivilege	2080	shutdown.exe
Token: SeRemoteShutdownPrivilege	2080	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3776	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2080	668	cheatengine.exe	83
PID 668 wrote to memory of 2080	668	cheatengine.exe	83

C:\Users\Admin\AppData\Local\Temp\cheatengine.exe
"C:\Users\Admin\AppData\Local\Temp\cheatengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SYSTEM32\shutdown.exe
  shutdown.exe /f /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2080

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a16055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-0-0x00007FFC1B673000-0x00007FFC1B675000-memory.dmp

Filesize
8KB

Download
memory/668-1-0x0000000000C20000-0x0000000000C30000-memory.dmp

Filesize
64KB

Download
memory/668-2-0x00007FFC1B670000-0x00007FFC1C132000-memory.dmp

Filesize
10.8MB

Download
memory/668-3-0x00007FFC1B673000-0x00007FFC1B675000-memory.dmp

Filesize
8KB

Download
memory/668-4-0x00007FFC1B670000-0x00007FFC1C132000-memory.dmp

Filesize
10.8MB

Download
memory/668-5-0x0000000001440000-0x000000000144C000-memory.dmp

Filesize
48KB

Download
memory/668-6-0x00007FFC1B670000-0x00007FFC1C132000-memory.dmp

Filesize
10.8MB

Download