Overview

overview

10

Static

static

10

b8b78dcf13...d2.exe

windows7-x64

10

b8b78dcf13...d2.exe

windows10-2004-x64

10

b8d253be83...33.exe

windows7-x64

10

b8d253be83...33.exe

windows10-2004-x64

7

b8ed4395ab...f9.exe

windows7-x64

7

b8ed4395ab...f9.exe

windows10-2004-x64

7

b93347150f...89.exe

windows7-x64

1

b93347150f...89.exe

windows10-2004-x64

1

b936c3a846...59.exe

windows7-x64

1

b936c3a846...59.exe

windows10-2004-x64

1

b985e2e2a0...ef.exe

windows7-x64

3

b985e2e2a0...ef.exe

windows10-2004-x64

10

b99adb733f...40.exe

windows7-x64

10

b99adb733f...40.exe

windows10-2004-x64

10

b9cfd0a072...65.exe

windows7-x64

10

b9cfd0a072...65.exe

windows10-2004-x64

10

b9d4ce4583...bc.exe

windows7-x64

10

b9d4ce4583...bc.exe

windows10-2004-x64

10

b9eb72c666...72.exe

windows7-x64

10

b9eb72c666...72.exe

windows10-2004-x64

10

b9f7b13b1d...ef.exe

windows7-x64

10

b9f7b13b1d...ef.exe

windows10-2004-x64

10

ba0566e43d...23.exe

windows7-x64

1

ba0566e43d...23.exe

windows10-2004-x64

1

ba21b0abda...c0.exe

windows7-x64

9

ba21b0abda...c0.exe

windows10-2004-x64

9

ba4d84a77a...85.exe

windows7-x64

10

ba4d84a77a...85.exe

windows10-2004-x64

10

ba598ceed6...17.exe

windows7-x64

10

ba598ceed6...17.exe

windows10-2004-x64

10

ba6c7a8dc7...59.exe

windows7-x64

10

ba6c7a8dc7...59.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ba4d84a77a0cf661df6c88fd41e6d9688f0d2a98ccbdc0555941206969c2df85.exe

  • Size

    1.6MB

  • MD5

    7ea9ab2735abf3ed79269a0b44ddd447

  • SHA1

    92e8b7c97db955d908a108764cb570926d2fa2ed

  • SHA256

    ba4d84a77a0cf661df6c88fd41e6d9688f0d2a98ccbdc0555941206969c2df85

  • SHA512

    b6bd25318dbab31b4e56ecb35a1a11efff6fcfa3c92a16432f55acf8082fb5f90f0a9a8b1774a11711ffa832fef639edfbf58dbbb4213b356619a2c799433254

  • SSDEEP

    49152:94FdetMVCK1LVXXQezP3+Wgm18VeWoAVvqPDe:OdkCCK3XXQO18VeWTVvqPDe

Score
10/10
xwormrattrojan

Malware Config

Extracted

Family

xworm

C2

vanechkin-51361.portmap.host:51361

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba4d84a77a0cf661df6c88fd41e6d9688f0d2a98ccbdc0555941206969c2df85.exe
    "C:\Users\Admin\AppData\Local\Temp\ba4d84a77a0cf661df6c88fd41e6d9688f0d2a98ccbdc0555941206969c2df85.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4312
    • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
      "C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
    Filesize

    1.9MB

    MD5

    ec801a7d4b72a288ec6c207bb9ff0131

    SHA1

    32eec2ae1f9e201516fa7fcdc16c4928f7997561

    SHA256

    b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46

    SHA512

    a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    Filesize

    85KB

    MD5

    2110dce68c8b52f3cfd4e53c5d8434c2

    SHA1

    b6c51e2e4009c0ab5e8990b85a39ca57659a9b66

    SHA256

    17b7b15868c80b8190eb9ddc168c420c90f5da386c166c86e51fdcda96911f6a

    SHA512

    b5dca21533bc1849a70804da37e3787f086513e8d57fe737c265b8ba5b60d8bb85b485b3e46d24f4590686e3d7d2cad32fd77b8f0438be114623987ab9858c2f

    Download Submit

  • memory/2040-30-0x00007FFF537A0000-0x00007FFF54261000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2040-37-0x00007FFF537A0000-0x00007FFF54261000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2040-36-0x00007FFF537A0000-0x00007FFF54261000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2040-32-0x000000001E300000-0x000000001E312000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2040-33-0x000000001E360000-0x000000001E39C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2040-28-0x0000000000CE0000-0x0000000000EC6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2040-31-0x00007FFF537A0000-0x00007FFF54261000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2568-29-0x00007FFF537A0000-0x00007FFF54261000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2568-0-0x00007FFF537A3000-0x00007FFF537A5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2568-11-0x00007FFF537A0000-0x00007FFF54261000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2568-1-0x00000000008C0000-0x0000000000A56000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4312-26-0x00007FFF537A0000-0x00007FFF54261000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4312-35-0x00007FFF537A0000-0x00007FFF54261000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4312-23-0x00000000000A0000-0x00000000000BC000-memory.dmp

    Filesize

    112KB

    Download