Analysis
-
max time kernel
866s -
max time network
893s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 15:00
General
-
Target
15415145.exe
-
Size
59KB
-
MD5
6c091ad6fae0fa76f44870d1a1b05cb4
-
SHA1
040f60c0ee3f4902f919025057e34ab4d11b1abd
-
SHA256
c352c942b6df33510094c7100fb9d48e36b8e1e2af40a60ccc360b58721c2390
-
SHA512
3a414f40f99e5847d9631c4ac1143c76e77db7ae42dd8c7aed2ebf1742ec73bb802d54d6cbde3b04f6b894a4cf731aa4e9dbad95166bade13f787b489d8e8d86
-
SSDEEP
1536:skyZtyUQ8sBkROLW+UzbTH3gfm2qt0OgSko7:skItfQ8sBkROUzbTQf+6OgK7
Malware Config
Extracted
xworm
3.1
known-savage.gl.at.ply.gg:45116
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 15 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\15415145.exe"C:\Users\Admin\AppData\Local\Temp\15415145.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "15415145" /tr "C:\Users\Admin\AppData\Roaming\15415145.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\15415145.exeC:\Users\Admin\AppData\Roaming\15415145.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
59KB
MD56c091ad6fae0fa76f44870d1a1b05cb4
SHA1040f60c0ee3f4902f919025057e34ab4d11b1abd
SHA256c352c942b6df33510094c7100fb9d48e36b8e1e2af40a60ccc360b58721c2390
SHA5123a414f40f99e5847d9631c4ac1143c76e77db7ae42dd8c7aed2ebf1742ec73bb802d54d6cbde3b04f6b894a4cf731aa4e9dbad95166bade13f787b489d8e8d86
-
Filesize
1.4MB
MD57e43551a662f3a398009e767e9b9c25c
SHA15409fb58a37a0d5fabd33314d768827d0b902f55
SHA256781aa9a9efae8411f470ab82bc8d60180f921d48ebb43adfb43109625b369a75
SHA512865e57f3d67707e4e152bc25f19d8acda94c4812b16d26511b766ac1c04a85278c859691138fe190c3b3e9f159fcb3d6f2f0907b8f543ee1b7578f9a463b8097
-
Filesize
360KB
MD5b5ab29c40aec3002f37df81941085f9c
SHA1144251d76d187a0a49f652ce0ce0d4dbbe7f3e7d
SHA256dde9ff22480cfc7a0c9599a6d612e7c764ef77016009a2f9012b18b832f76796
SHA512902a70313a35baa4e28d97aa29c09490f0863594054e79347629b796c626fc1333c7831903bba3215f053801df36444a9a9fa0261a25d3c2c8bb886655b92e96
-
Filesize
974KB
MD502e9b808d71533f17dd009d852f37eaf
SHA125b727de9b5385d8763f6db561d32473355ea0fd
SHA256df4a8db6eaa7c9692786ffd5d80dc6bbd850889ece8c463f31a9ef53939ea1d4
SHA512aa67fb358ab2fea53eaa29f8a793c4166285d48d5fe31e9b7e81ca16df943de50b2cc8bc7e029f1109843bdadd064ba6f1397cadb13c01b99f869b01594d5956
-
Filesize
787KB
MD5c53eed484084dd8db5ade69ea38b929a
SHA1fa40bc15f2a52ab649080ea3c41ce3fa78c93ac4
SHA256f5f2b8d2bda0b0960f2c5a2e10429e600d1e181a22376a6449ac67868355fe76
SHA5129da50f908d074307d021c547457823e292b02a51e8b865503d632e389e10db9fa4214088db83309875dfdfa4b11811159ac047fb4de02a27e79959fe74b69bcb
-
Filesize
440KB
MD5851ff23ec947c790fa9fd697d372898c
SHA1a282f457c3cba86ae4832a42042c274d507d0a68
SHA256fda7de89865eb1e8075b139fb105fcbb12f4737824a87ee665b720914550267f
SHA51276be5250267fa059f36ca53fba738fceaa5c1c6a992a03bf8c0069ad85821a982a72e311de8407780f1e3185dd57dcaa2472e99635ba06fce716f6a8bc750b86
-
Filesize
1.0MB
MD5a20aca4aa5becc03805def164b419e01
SHA1a05ee5d7d684518b8f023e55c91a05fe4420fd49
SHA25632755c44b6395830011b3ab20d4699332c8221346dc65105ca6276968996374a
SHA51248665e377700eea4658f8c91bd05671a8a05cd87dbd6163e9b418c2d5e45fe732b37ac162f609850010c17920336447fd30648e27e8ea119472dbd68dc700dec
-
Filesize
733KB
MD5fc58eaead5664d8caf7261f7ecd24fb8
SHA146b7a1dac69bf0cb6c63e855809dcfbecdc47bb6
SHA256c67f465ad22395f4de9595de826a3c3a5e5404051f949c2377a757edb7d6efab
SHA5122076978f757e3c4f61b95380d45819958c01d70d553c62ab6d1138398d99eeee2c32f7a4175a3b298953d34c00ad3fbe4f284c0eddfd9c64c7b9333dd0834081
-
Filesize
13KB
MD514bd11c553df7ddb39a20b6bebbfc797
SHA140ba6d4f1e3bce2197b805d15ba3b3f4f5a28897
SHA256bd06bbc660dc0338aab2d2f49c9067199137bc819a08614e73ba713cdbedd2f9
SHA5122a440a8448e982da8335808fa0d670c0f507f7aee6740a279f642e656c30186152e668cb09d7ebda8985247e26c22a4ddda0ef5e47e55568e9c282f6986d8401
-
Filesize
573KB
MD5c7b5b3fa69ddc98f3971b6f0fff375c5
SHA188c6c2f3280aec141841eb72cc16513d09775ddb
SHA256999c82f185d9ff434980dc67c1dbd8fed5dfc2681f940f58dad96bbf950f148b
SHA512bdcad2e888e6212ed4d2e7120d9c9c844dd903b9a99f1aed1b9c9cf920d21fbc3ea0d878f5e8f49896113d445292e676c6219a7180d9c057029de5d26550bbdf
-
Filesize
520KB
MD5a468464d14d936efe5ad48238e973ba8
SHA18072283c8d8872d6f1bf1aaed45abda84419d4ac
SHA25601dd09e95b43c3f5fc708f790e0a147edd776fc6207d9ef756962eab10f14ec8
SHA512248b463405b96167cda9c5edb0c10c2d147ea588e77d022f6b700bd61074fab3dad6ef61e73f2a8757bd2ac3332aebffb6a0777761f2e49583307dcb6e29f907
-
Filesize
760KB
MD57d5949282095825e84061201b9d00ffd
SHA1f8fca3b7277a78a83959985a9f18918d9825856f
SHA256143fcae6cd4e495a50bd7af4b719283137ca8eaaad04d7323804cf880e9537bb
SHA5126f835d0c4fcf542a27843819f46b6c2aee20d9192bba8121d052e72549cc16b4a9669b0a92155313a5b485cc903d99dd66d3d898a1283bc5ade84d1b3e0c60ac
-
Filesize
813KB
MD59072ae5fa2acf189274bd6de2a5255fc
SHA1646d77d14af9d017cdeb1ba1bacc840d2088d1f2
SHA256d093c1468c25dad7acf85086a59237d6374790fb9396b93846b8cc9f06db6922
SHA512311b1daf1b85fae00b5d0d53ab1d7b3cf509f8dc1ad6aa9b5926f808bbf2c623d9028c5657e768f29c142ad431599e17ce12d450bf9f2f1c05da9a5b56a7dec4
-
Filesize
2KB
MD5e38941d4a6f0b9ccced7289e75c6cecc
SHA1b5d57843c68bbf4d45958b4dea8046d4c4bdb13e
SHA2565fee93634a60723ba21f9c7e58fc2e04b83aaeec79790a737e7b823e4ab9afc7
SHA5124424a2f8515b4f73592d0fface79f85d765ff225cdee0fe6dbbc2d76c6f3e16c00357b0ca4d08a3a47f1c4a01dd33b52448279818b99a5897f8ec7ee653703e7
-
Filesize
867KB
MD529befb54b9e193bc01d2b227d453baa7
SHA14e49f6da0bf2365fb3b60773bbcefbc290ee49e7
SHA25680ed161d2c11d4ecffa13f0a42c813d070145b3d7da73a1ec1ba2746cc0c4e65
SHA5121b6e6d82e7dc6e5d100284bf1fa7bac463d93e0cdcb2f8c2f0226cf7ba742f2d0dc6c0516772645e70e1c66449871b44098fe30b04f0a1f08de918cdfe3fec12
-
Filesize
947KB
MD5a9e9d8353ebd145b1ac112ab6ddd226b
SHA19f8e4a7e1258614706af38d59fbf03a2bfc87fa5
SHA2564113afd77d853c5bbce274cceb910995ee89a439afff8a3a1330b68cf390e86b
SHA51257e840574073b1ae4d17be0e63018461fdf7cfd4513683dc24ce8494ba55d38b149ec72df0dfa72ba42b21cd5cc6b409c2e6283da747634520e2cc19f74f0fc4
-
Filesize
627KB
MD5f7a3882c7d75c6be35eb96f9ece0e4ef
SHA1b2b7730ea41d8744ba98daf5931cabe54b48cd8d
SHA256fcd25af14219783cd67868be73443551c77147ccf6784e1fd64be36d3c26144e
SHA512bdddff14c6dc103c6f238e97ba8dad5ceaf6f1df25432dad0cf7ad66a9dfa2f8bb92de4e5fe2d8599c28f4f607487e272da98d8e2f87c3fc29bc2750b95a5a14
-
Filesize
12KB
MD583dfa45380e062394fe0d8ca6fb819e3
SHA19f00e59f3bdf29aab981865eaa9534c1d190af75
SHA2563968cc30af65f757811a6e74adeb83e6787ac31491b1e9011a4b633fb40122e9
SHA512c07c8b50c0b99a6b847662054222a41fb44e14423fa7517d16ef646a45cb7477b8f6e6bc0e5695ffa880c15e393bba071455657f296269619d84a0a71b02a498
-
Filesize
493KB
MD58ae66a02fad919693a4997cd2c9d5fed
SHA1074751a8dacda342d9f899409cbf263f3781491b
SHA25608b438ff4b239f6ce4ffd4dea282ed55e07fbbfa315677a469c6422f241b7651
SHA5129a82afbb83a51e06ccdc9ac75d228028efbc6c326020a8aefb1ba77555137986bfd8085b2032884fb9c9aaa493f9157943e37f889f2a7d2c52c2a54f7549c704
-
Filesize
547KB
MD505e3b4b60a5d6273745014d9465a21a8
SHA18f75979174c8f51778356cbb964f77e34bc22e14
SHA2565366d04b6195b4bbe7f7d4b657b5fbd1a7d8e5cef2dc3b0623ac54614de416b4
SHA5120d282dd93eedbc48d5c86f947dfca4f0714848aee1339c93121bb9e6215e458a4a6f9ef57a0d28a429321fea88f8a06b14d673af2a364d0bda75de6fca7bf2da
-
Filesize
653KB
MD5cbc9f8ba34069d96e69031237e0ddcd4
SHA1753243e0093c1dc745bf0956c4fecfaf24d03c86
SHA2562b7f65a00aa422dc83a79d87dea6b1e81219260023a141b201dbdb84b43893ed
SHA512849e54a0b720fefc233b495a8d93d7a4992e86abd23e58749d1ea61eae11efcb20e724ba70f50fe071381e97cfee7c7927f52946c85615e4251dfe55ce741103
-
Filesize
11KB
MD5d108a37536f778c2ee9868e2e5f3d87d
SHA1eb9c9174a887852da39ecb0393fab5548b7d987f
SHA256523868362fc3b29c35a3803034d4e9a611b7ac20ccdf8e1d4ffc5f2d51073164
SHA5123b6df65e9e0091a17856e9180f890761ae671c89725d2c1dd49fb6187f507ef8f97400a553d349ea9ac673d6ec81f994b7270a9fba416ad1955b7fecf5769170
-
Filesize
680KB
MD5daab63e3ff4cd734e14e0b26e243043c
SHA14c5cd124aff327f2d00c87b272795641c0a4e901
SHA2569294828e1081a8e6c60eb7fe559f30b5f1caea7c75dc4b69e60358dd5c243de3
SHA512e9e41c99db478b1b2f6b512b257b790464765da403004f73082e7b5fe6af6727e0d51983bb1d0c9d300bd7cc13d2201587742db7f54253d6ae8bc216c8fc8f7f
-
Filesize
600KB
MD5d7d11e43fba783827bdd593aaf197bc7
SHA1db25bd67be7945fff93f3c17364ef646c8a05f71
SHA256a8e08e202c4dcd9061178d2a4c3646999839b18e471afb84de942446172cb1f8
SHA512ec585a0edc78f81ff953583f967888d6e7b6dd6f6224cd2c2e406784d20a55cd5aff3f880e57245a351e14ec56812006c07835386c8d009d56c77b0b121bea71
-
Filesize
1000KB
MD5902d9cc673b4a29ccb77ddb1d244c801
SHA1e1f7e562d0f54ddc6faf247fe4a19bb093c0da73
SHA256eec9dd1c070f0883d7a1b43b40142f5ce6f3d48f951bd50629aec26fed26aff9
SHA5129d693aadbadaa476af44ca98800ae3f83d6f290beef69e276ac3c7c2de978326514034271c3083e5e4cb4e27157ceaab3cadc4b8b0bdc1c8573858d7c0dda79d
-
Filesize
467KB
MD5d6f2ba2c41fb8d714f38d2a69de9ee57
SHA1392be89be2d7e9b225e0c5667fec175129fe39dd
SHA25648cac6a1cd7323f289140472553fba0e5a3fce494b7859917659e332ebd535e1
SHA512c107ab56ddd7316410c7755f3f3c5864c9ac7964fab18c288384e2879cc478e86e4f0f0c1219ed4c88fdd4dbb897f847ec44b0c24a815a427450ca24eb6634de
-
Filesize
920KB
MD5830d4019a77ddab8872d1cda91493c8d
SHA176820e106d6696c81e5c850bebf02b1470eca599
SHA256df370f78449d0a2b9cfe6c046426302568e404927e82a209722606c4265c1e64
SHA512fd441f20a34ec9ecf66f789e713bca87c75912c72adb93cb2d283a78973b7c8b1ceee04c15c438ef3f27c1d4ca9c06256017c3dd62f2c82519b32f3ef23cc492
-
Filesize
386KB
MD5c7f10bb669c28e5140744f283e0c7675
SHA1f97cfc0e29e30b08ec71d589347bee7048ce2e3e
SHA256ddaa11b6edc5dd5131be47f49dd252c9d76223a1ad2637d85d197a19360bc28f
SHA51241abd7c97fe515b178574fa72b53df0c54862b1f4ed7a0374322f0e552a98250c0bbe2bfc668172a817bebd91ce29ecfc6668825b84afff68e024d4581a232d8
-
Filesize
707KB
MD57bc19b57720c9b960ba43648601a65a3
SHA1f63582c7a7d3598d6acb9ca9e799af0e40744ec6
SHA25681f69abd4e2109e85abde96466621467128a19138476712b2e4e2699dc45710e
SHA5128ad137d3f0c79088c8d618c281447d6704a8470b6edf151cf4b150851adfa2e6c6c20df3da6e2b2f75f3ca0738d87c1aba39a1ab4e4e1a4ddb6f88fc65999951
-
Filesize
840KB
MD592b7ebcab204c1941cfcef21c5ca32d8
SHA152cb312de615be4c907b9a24b80fcd7e72c8e04f
SHA256f20d9752443fe17d88d4e7a4184153e251cd1ee0490f7c2ff735d33cdbda8e9b
SHA5127d381ee43363f1d9f0324c844673bcc3b0b04ed3caed62fd04c503d35958ef5565c484dc9e88ab3fd6931c76352218594ce44efbcbc4915a170deb95e5a3a433
-
Filesize
413KB
MD5589da0bc7f0a05bf39adfaf4de64f7f8
SHA173df832dc0b2c60f8f820305cc9e1177af87023f
SHA256a3ccb05299875ea0c8fdbceed2d0f57df516784fd527e25ce148c11ae777d281
SHA5121ef3d48a610f6d4c21f02469245f30ca7f04573d327121006b0f064a1c956052b89ac9403ef21ec18129aa90e5f24ead5b9160356cfd038e39ab73db0636f2f8
-
Filesize
894KB
MD5dfe2c371710cc972df68770cf0c09cea
SHA189e7582f0e2f8e0f43345124a81d29698ee09ade
SHA256a0d7df577d5aae6eeaf3eeec11183ea2ca4d32fdb5e1b4766ff3716706ffef4b
SHA512b58f762195f6fc9a9cc73ddad700d16aa1ebb6bf1a5d1fdcfb4df764d3cb07ba2076aab1b5b28a43047a7c6730f1dd1e2d5e81beb0c87af5aceb661e7d674cab
-
Filesize
2KB
MD5e5ccf08dd2ec3fd5b3283e3acd738e21
SHA100a9560622280c16f11dfd379b131ebad4d3839b
SHA256f968c04b67034e11b9a90736ca21c9a3b53d1f57c6614bc97c74c8e3a1b2ddf5
SHA512077746409012414fd01de054e56475d597820fb6717283dfa3751251b86cda095122c5497a26d2d197502284fe8b69f84871661b561370e55d5795a445697c49
-
Filesize
1000B
MD55b4808de6d4a285089bbb29bf789cdae
SHA14af5af1e97433a2ae8850cd7aa329c21d018b125
SHA256484cfc7ea33e2b6d4b7748c02a3fe6fad99811f7074932d057d6b84303f0c3ee
SHA512a636de4b16a667e07e42a8dc09c875831bb3d979f83b6e3678319a32dbd6de20c521ee1a86ccbece65f2bf4ede7aa92b7d6830e300048ceaaf7600ca2663505a
-
Filesize
2KB
MD5f10d3c066617c0176bbc94b41d655d76
SHA144b2f66730ea406e5e01ebb8dd13de971a6a9a5e
SHA2561e51e1a2794331fb2cbef6e39fc78ccc60b057fc160b1b599dba6e86dbe22acd
SHA5123b4728296211bf3486f9cab796977b87673a34a748a9d6e134db12cde63667cc63c020b979181c72ba80d598c97526f1785c6574d718f54c95d4e9de95536aa8
-
Filesize
923B
MD5bcf0f175448af9ed659c37c00fb2c803
SHA1331765cb401a734b10eb0a60c1f5a5d358417815
SHA2567fe5c4e11ba4d13c1384a43fdfdd23da62a67b86faded43aab69d1ccb715f585
SHA512e7c1b9747116c0ba979cc01be4d29c60197d5cd670e242822bd544af5e469c1a461bcf3720f42f0fdcad4b281beaf9dc91a3ba77e003e830a4c1504761aa3302
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
88KB
-
Filesize
520KB
-
Filesize
10.8MB
-
Filesize
10.8MB
