xworm | de4e0c559892f2e6532a81f41f2dc7881abcb21f10cef2f0b8e1c08f028ed274

Analysis

max time kernel
95s
max time network
144s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250218-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250218-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07/03/2025, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VelocitySupportTool.exe
Size

409KB
MD5

89c1e3a7ec9d20a6a19d33733ddfb45d
SHA1

92e295c1a64cb1a7cff25da640d427d494913ea6
SHA256

de4e0c559892f2e6532a81f41f2dc7881abcb21f10cef2f0b8e1c08f028ed274
SHA512

8a0db537fb949c274db4bc0ddf1b8e1075fe9a944c72e0f2790846288844a81870afdd549dfe2850deabf34aebfeca38faddf49128f3a25ce99660421858998d
SSDEEP

6144:WzgYQ6Sr8vQUroyIzypnSiO3duT8dQ5dAGgtxLnCN9eo9kMAfjKFfjqKatZqFYp:Wzg0Qw1mAyQWtxjyeoOpjK8H

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%AppData%
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/izCnqikF

Extracted

Family

xworm

Version

5.0

Mutex

qxXFT7Xfzgf1uMiL

Attributes

Install_directory
%AppData%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/MNJM1De2

aes.plain

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000c000000027dff-6.dat	family_xworm
behavioral2/files/0x000a000000027e07-18.dat	family_xworm
behavioral2/memory/1768-32-0x0000000000B40000-0x0000000000B88000-memory.dmp	family_xworm
behavioral2/memory/5016-31-0x0000000000320000-0x0000000000348000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000\Control Panel\International\Geo\Nation	VelocitySupportTool.exe

Executes dropped EXE 2 IoCs

pid	Process
1768	VelocitySupportTool.exe
5016	VelocitySupport.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	VelocitySupport.exe
Token: SeDebugPrivilege	1768	VelocitySupportTool.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1768	1288	VelocitySupportTool.exe	84
PID 1288 wrote to memory of 1768	1288	VelocitySupportTool.exe	84
PID 1288 wrote to memory of 5016	1288	VelocitySupportTool.exe	85
PID 1288 wrote to memory of 5016	1288	VelocitySupportTool.exe	85

C:\Users\Admin\AppData\Local\Temp\VelocitySupportTool.exe
"C:\Users\Admin\AppData\Local\Temp\VelocitySupportTool.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Roaming\VelocitySupportTool.exe
  "C:\Users\Admin\AppData\Roaming\VelocitySupportTool.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Users\Admin\AppData\Roaming\VelocitySupport.exe
  "C:\Users\Admin\AppData\Roaming\VelocitySupport.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\VelocitySupport.exe

Filesize
138KB

MD5
a705df8248ae95c4c123793b6235821a

SHA1
4eab0a8288be174489b3858ecb7ef1cb673c2799

SHA256
4ee52b38617c54e3445e3bfadbca1776d577ff50f88169c3613852d16eb39ba2

SHA512
5b41d3ef942c0e5ae137d7dcac59aaa782697e9de35f9a7a8a096f27e3a9c88ba16307ec24caf1d26c7db7f50f3f4568b48f01b9542ea0551db416e43d94bef0

Download Submit
C:\Users\Admin\AppData\Roaming\VelocitySupportTool.exe

Filesize
260KB

MD5
b6146f0fe72e1c9095f635f5e16cfa04

SHA1
995aca3575dc15568669b23574c909bd1a32df7e

SHA256
4352c43fd5bca3c41abe3051190ce1f83da64158d564330ed5375d3fd40b156a

SHA512
cb6f968a4fc7390979e03b68cbdc6ad99975be950776dc963f904e0ca21d55bff86ac6010f580e6c6d98015859d7667cade850150c38f2123da29df23b2627c0

Download Submit
memory/1288-0-0x00007FFFE40A3000-0x00007FFFE40A5000-memory.dmp

Filesize
8KB

Download
memory/1288-1-0x0000000000FD0000-0x000000000103C000-memory.dmp

Filesize
432KB

Download
memory/1768-32-0x0000000000B40000-0x0000000000B88000-memory.dmp

Filesize
288KB

Download
memory/1768-33-0x00007FFFE40A0000-0x00007FFFE4B62000-memory.dmp

Filesize
10.8MB

Download
memory/1768-36-0x00007FFFE40A0000-0x00007FFFE4B62000-memory.dmp

Filesize
10.8MB

Download
memory/1768-38-0x00007FFFE40A0000-0x00007FFFE4B62000-memory.dmp

Filesize
10.8MB

Download
memory/5016-31-0x0000000000320000-0x0000000000348000-memory.dmp

Filesize
160KB

Download
memory/5016-34-0x00007FFFE40A0000-0x00007FFFE4B62000-memory.dmp

Filesize
10.8MB

Download
memory/5016-35-0x00007FFFE40A0000-0x00007FFFE4B62000-memory.dmp

Filesize
10.8MB

Download
memory/5016-37-0x00007FFFE40A0000-0x00007FFFE4B62000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads