xworm | 2c9e685a4794cd19497c3d1fd8eb7b7f6954aed7b6d707fe3ec73ca243c842d8

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2025, 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c9e685a4794cd19497c3d1fd8eb7b7f6954aed7b6d707fe3ec73ca243c842d8.exe
Size

609KB
MD5

057d1b4db652dce1eb4523352247706a
SHA1

148b7fb8db688e258bf9f44bbe5e9d3ed08f7402
SHA256

2c9e685a4794cd19497c3d1fd8eb7b7f6954aed7b6d707fe3ec73ca243c842d8
SHA512

e2ecdc34cf60eb406122348ecfa4e2eee5e3bd068f94b7d40a6d2e06debe66dd04f7df2b630324d982b40ce065f399f77982369d131403480aae19b01452a731
SSDEEP

12288:TITw2OrZu5MDbsJlgK5dZ4UjYCUbTgjwGEJRjN:cTZOlCMPsJGtCUb88Gm

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

147.185.221.24:24206

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000600000001e4dc-7.dat	family_xworm
behavioral2/memory/2184-10-0x0000000000040000-0x0000000000058000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation	2c9e685a4794cd19497c3d1fd8eb7b7f6954aed7b6d707fe3ec73ca243c842d8.exe

Executes dropped EXE 1 IoCs

pid	Process
2184	FIveM‮gnp.scr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	FIveM‮gnp.scr

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2184	4852	2c9e685a4794cd19497c3d1fd8eb7b7f6954aed7b6d707fe3ec73ca243c842d8.exe	89
PID 4852 wrote to memory of 2184	4852	2c9e685a4794cd19497c3d1fd8eb7b7f6954aed7b6d707fe3ec73ca243c842d8.exe	89

C:\Users\Admin\AppData\Local\Temp\2c9e685a4794cd19497c3d1fd8eb7b7f6954aed7b6d707fe3ec73ca243c842d8.exe
"C:\Users\Admin\AppData\Local\Temp\2c9e685a4794cd19497c3d1fd8eb7b7f6954aed7b6d707fe3ec73ca243c842d8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\FIveM‮gnp.scr
  "C:\Users\Admin\AppData\Local\Temp\FIveM‮gnp.scr" /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FIveM‮gnp.scr

Filesize
69KB

MD5
9040da37987c1b69b0480682b4259014

SHA1
b70b04ba0f4b06492a6101a6c1394eee5168a0c0

SHA256
803ef80c6b42b205632688212e915731a5ba645e941f9ab6ecc392012ec4837e

SHA512
bf5544705c1f989289f45e269b3d540dbf683795cda53cb1d688d73a20f487edc417e42de94949ead35b8f7e8f3f8171e9c2049f9cfe80091afe07859d4f65d8

Download Submit
memory/2184-11-0x00007FF9562F0000-0x00007FF956DB1000-memory.dmp

Filesize
10.8MB

Download
memory/2184-10-0x0000000000040000-0x0000000000058000-memory.dmp

Filesize
96KB

Download
memory/2184-13-0x00007FF9562F0000-0x00007FF956DB1000-memory.dmp

Filesize
10.8MB

Download
memory/2184-14-0x00007FF9562F0000-0x00007FF956DB1000-memory.dmp

Filesize
10.8MB

Download
memory/2184-15-0x00007FF9562F0000-0x00007FF956DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-0-0x00007FF9562F3000-0x00007FF9562F5000-memory.dmp

Filesize
8KB

Download
memory/4852-1-0x0000000000490000-0x000000000052E000-memory.dmp

Filesize
632KB

Download
memory/4852-8-0x00007FF9562F0000-0x00007FF956DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-12-0x00007FF9562F0000-0x00007FF956DB1000-memory.dmp

Filesize
10.8MB

Download