Analysis
-
max time kernel
126s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 17:21
General
-
Target
2ZRahoFPSz5NUBY.exe
-
Size
2.9MB
-
MD5
551bdc94c503bfeffe46d96eb21484f8
-
SHA1
b7313d730bb8f08774977229229d167dd272ce82
-
SHA256
413f81b625d636a96eeb41de781c777c5294e7f8f5c714a1921d005e7f46800b
-
SHA512
32d07f233f3b66a8863747b1239648e0154f17bbc9f5453a7dbbcbcb12263da31d8bed2e1194a634c8c2174635223e1abfe50bbd873ee3f60f37f77e8fb3ea59
-
SSDEEP
49152:ULkjyaZH575syNqACjngmISzn5TfBDgTZUJ4crvFnXI6Txjj5eHKf:ULkjyaZH5iyNqlTvfRvhI6Fj5IK
Malware Config
Extracted
xworm
127.0.0.1:12830
technical-tract.gl.at.ply.gg:12830
-
Install_directory
%LocalAppData%
-
install_file
PyslionV1.exe
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ZRahoFPSz5NUBY.exe"C:\Users\Admin\AppData\Local\Temp\2ZRahoFPSz5NUBY.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2ZRahoFPSz5NUBY.exe"C:\Users\Admin\AppData\Local\Temp\2ZRahoFPSz5NUBY.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 16603⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2812 -ip 28121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517B
MD54d737622dcf53d4cf89810ec284fdf89
SHA1a71b0c3ac6b940047ca7730465c1f97342c8ca08
SHA2567d5529c9d51a138cea4ae46faa32497ccf1e55d6bd5aa43f746d413ce80fa1cb
SHA512acf53d9d2ffe5e3dd34760e3c8e138229ee9805387ddf0765266ee882268cf64f84fb4a1b79aee3f90b88b50f1a1bbf10c9ba7a1013496059b46f3abe9c859c6
-
Filesize
2.9MB
MD5551bdc94c503bfeffe46d96eb21484f8
SHA1b7313d730bb8f08774977229229d167dd272ce82
SHA256413f81b625d636a96eeb41de781c777c5294e7f8f5c714a1921d005e7f46800b
SHA51232d07f233f3b66a8863747b1239648e0154f17bbc9f5453a7dbbcbcb12263da31d8bed2e1194a634c8c2174635223e1abfe50bbd873ee3f60f37f77e8fb3ea59
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
352KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
7.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
2.9MB