Overview

overview

10

Static

static

10

wad.exe

windows10-2004-x64

10

wad.exe

windows10-2004-x64

10

wad.exe

windows10-ltsc 2021-x64

10

wad.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    899s
  • max time network
    890s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250218-en
  • resource tags

    arch:x64arch:x86image:win11-20250218-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/03/2025, 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    wad.exe

  • Size

    140KB

  • MD5

    c99f3f8298b973b58d216288fefccc0a

  • SHA1

    ca849ae90f4df0f7951a1fa6943fe526c4cdbe9c

  • SHA256

    26653dd95cf0c35f757494fee76478a0532331e6271c323ebd2ee10d99c2804d

  • SHA512

    edae505b9f591061df6ef16041551c07fca169f058a781ec103e0acb9589df7f93d0200a064549cd0b003becbbdd417155e438c6fe36e7f3a3f3c7740be4bbd7

  • SSDEEP

    768:JkIFS2U1zigDKNgAWMLxOchH5Ft93vO+hmNFiD621sIwEk4w00wm:u6SoeIVhZFt93vO+INYWEC

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

Au6cWZUCNAOIflwB

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\wad.exe
    "C:\Users\Admin\AppData\Local\Temp\wad.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2908
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4200,i,4634074957638558700,2080510381543222728,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
    1⤵
      PID:3744
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3928,i,4634074957638558700,2080510381543222728,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
      1⤵
        PID:720
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4312,i,4634074957638558700,2080510381543222728,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
        1⤵
          PID:3140

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2908-0-0x00007FFBF9313000-0x00007FFBF9315000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2908-1-0x0000000000B20000-0x0000000000B48000-memory.dmp

          Filesize

          160KB

          Download

        • memory/2908-2-0x00007FFBF9310000-0x00007FFBF9DD2000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2908-3-0x00007FFBF9313000-0x00007FFBF9315000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2908-4-0x00007FFBF9310000-0x00007FFBF9DD2000-memory.dmp

          Filesize

          10.8MB

          Download