Overview
overview
10Static
static
10e64b687735...eb.exe
windows7-x64
8e64b687735...eb.exe
windows10-2004-x64
8e65dc6f84e...10.exe
windows7-x64
10e65dc6f84e...10.exe
windows10-2004-x64
10e67e28bf49...ac.exe
windows7-x64
10e67e28bf49...ac.exe
windows10-2004-x64
10e699919d5d...ad.exe
windows7-x64
3e699919d5d...ad.exe
windows10-2004-x64
3e70b65e1d8...21.exe
windows7-x64
10e70b65e1d8...21.exe
windows10-2004-x64
10e7193d3473...84.exe
windows7-x64
10e7193d3473...84.exe
windows10-2004-x64
10e740e379c5...b9.exe
windows7-x64
10e740e379c5...b9.exe
windows10-2004-x64
10e751c36e12...39.exe
windows7-x64
1e751c36e12...39.exe
windows10-2004-x64
1e7573bcf85...a1.exe
windows7-x64
7e7573bcf85...a1.exe
windows10-2004-x64
7e787228874...9b.exe
windows7-x64
10e787228874...9b.exe
windows10-2004-x64
10e80000db8c...4b.exe
windows7-x64
10e80000db8c...4b.exe
windows10-2004-x64
10e82aaf456a...e7.exe
windows7-x64
10e82aaf456a...e7.exe
windows10-2004-x64
10e864953c3a...53.exe
windows7-x64
10e864953c3a...53.exe
windows10-2004-x64
10e8686658e2...12.exe
windows7-x64
3e8686658e2...12.exe
windows10-2004-x64
3e8add32344...f4.exe
windows7-x64
10e8add32344...f4.exe
windows10-2004-x64
10e8cdbe10bd...14.exe
windows7-x64
10e8cdbe10bd...14.exe
windows10-2004-x64
10Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:18
Behavioral task
behavioral1
Sample
e64b687735f08d83a710e6e493346feb.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
e64b687735f08d83a710e6e493346feb.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
e67e28bf496e7f9625bf94a126253aac.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
e67e28bf496e7f9625bf94a126253aac.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
e699919d5d4dee2a70455861a6aeddad.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
e699919d5d4dee2a70455861a6aeddad.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral9
Sample
e70b65e1d80063b1fdfc5b439f8ec121.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
e70b65e1d80063b1fdfc5b439f8ec121.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
e7193d347375dbb471134f1772410284.exe
Resource
win7-20250207-en
Behavioral task
behavioral12
Sample
e7193d347375dbb471134f1772410284.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
e7573bcf859fd192353ba79f43e0cca1.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
e7573bcf859fd192353ba79f43e0cca1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
e787228874f75520e2a95df7768ba99b.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
e787228874f75520e2a95df7768ba99b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
e864953c3a95b063ace86177e1914753.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
e864953c3a95b063ace86177e1914753.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
e8686658e2163a23de75fe75807e0d12.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
e8686658e2163a23de75fe75807e0d12.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe
Resource
win7-20241023-en
Behavioral task
behavioral30
Sample
e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
e8cdbe10bd3316f1f52cfd57c431f914.exe
Resource
win7-20241010-en
General
-
Target
e7193d347375dbb471134f1772410284.exe
-
Size
41KB
-
MD5
e7193d347375dbb471134f1772410284
-
SHA1
cb2e5a367488fc004eb6469cdc49d8278835efbf
-
SHA256
ff976ade83191c5dbd4a095a3755faeb92ea0fef940a9e191c1e92a2e448ba16
-
SHA512
f8ff2e91511d1060a414c029b7fe71009ce10e90dc4e0cdd66f1051cbfd01f7adb68b0843708dd8d6d86a846401d7a84f97528a74ea3b54fb35e7ec49c9e5550
-
SSDEEP
768:EqZAuyVGTZgZm5Plxjvr6F5Pa96NN106tOwhk33Qw:EqZAuy8ZYmBjeFY9oNS6tOwCgw
Malware Config
Extracted
xworm
5.0
27.ip.gl.ply.gg:4563
MF6dhFMwgcljrzUB
-
Install_directory
%Public%
-
install_file
rozetka228.exe
-
telegram
https://api.telegram.org/bot7809829240:AAGhYA4SPUVIk4XcRD9Y4PjF3oUrHO6XJcM/sendMessage?chat_id=5838837539
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral11/memory/1988-1-0x0000000000D70000-0x0000000000D80000-memory.dmp family_xworm -
Xworm family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1988 e7193d347375dbb471134f1772410284.exe