xworm | cf72e60bc72abd3c24aaeaf3382f2ca4d9c78fad4f0e4c0e766eb999fa4fd11d

Analysis

max time kernel
854s
max time network
887s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
08/03/2025, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sex.exe
Size

108KB
MD5

172786ddde922ef8c738488188957be6
SHA1

d3ac8d959d7ed442c91759ce4f6d1fd1bd271512
SHA256

cf72e60bc72abd3c24aaeaf3382f2ca4d9c78fad4f0e4c0e766eb999fa4fd11d
SHA512

105289eb9c168dc859e31b9b37e76c80b000960e88b6e6f0df7ade3a8938b94ccfb087272564af28fc7d56b2bf6681b414cc59d866f9f0ad17afd208bdb430b3
SSDEEP

1536:v2SENAgpuW+LpyOQGTrePk5QgKYXsIpsd0tiA/EdipjNd+FXwD+X4vBr52WBHPsH:OSENABoCoonMyBBzvBXvWjO+L

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

any-attraction.gl.at.ply.gg:27770

Mutex

B33wn5oKUxMok1Li

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral3/memory/1596-4-0x0000015F5D770000-0x0000015F5D77E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	sex.exe

C:\Users\Admin\AppData\Local\Temp\sex.exe
"C:\Users\Admin\AppData\Local\Temp\sex.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1968

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\a51bfd3a-7483-4ec0-97f3-7e8611d264b5.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
memory/1596-0-0x00007FFF943F3000-0x00007FFF943F5000-memory.dmp

Filesize
8KB

Download
memory/1596-1-0x0000015F43140000-0x0000015F43162000-memory.dmp

Filesize
136KB

Download
memory/1596-2-0x00007FFF943F0000-0x00007FFF94EB2000-memory.dmp

Filesize
10.8MB

Download
memory/1596-3-0x00007FFF943F0000-0x00007FFF94EB2000-memory.dmp

Filesize
10.8MB

Download
memory/1596-4-0x0000015F5D770000-0x0000015F5D77E000-memory.dmp

Filesize
56KB

Download
memory/1596-5-0x00007FFF943F0000-0x00007FFF94EB2000-memory.dmp

Filesize
10.8MB

Download
memory/1596-6-0x00007FFF943F3000-0x00007FFF943F5000-memory.dmp

Filesize
8KB

Download
memory/1596-7-0x00007FFF943F0000-0x00007FFF94EB2000-memory.dmp

Filesize
10.8MB

Download
memory/1596-8-0x00007FFF943F0000-0x00007FFF94EB2000-memory.dmp

Filesize
10.8MB

Download