xworm | f3aa2b23a67f4dbcce9fff7bb084e70127e3e0c4f2ab0f605487c570a7408960

Analysis

max time kernel
102s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fd711c9c2d9499442df85e477e670c6.exe
Size

91KB
MD5

6fd711c9c2d9499442df85e477e670c6
SHA1

b0060d9847183d79246b89105f93ade22c030723
SHA256

4b0643e246975f409a05d1f660b078de4b828b18cce4c70ae21906d0308cd9d6
SHA512

012abb90437ef84d8871263197a4c27083e208bfde48192803928bb3c37aa558aced546eefd56aade51a64d4d1097523df5ad55fc99a356a2cf4039a9bbfdb45
SSDEEP

1536:atk185fIMs/fmejKu6jHGd2nD3gKvxiBGmgkGPIqXin0i4FcXVQ:atkK5fIMs/fmejKuivz9vxa4kGPIqXG2

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

ring-staffing.gl.at.ply.gg:32707

Mutex

elbD0YZaBQfsICaU

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral30/files/0x00080000000242fd-13.dat	family_xworm
behavioral30/memory/100-21-0x0000000000F10000-0x0000000000F20000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	6fd711c9c2d9499442df85e477e670c6.exe

Executes dropped EXE 2 IoCs

pid	Process
1208	RAT_1.exe
100	Windows Session Manager.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	100	Windows Session Manager.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 1208	5592	6fd711c9c2d9499442df85e477e670c6.exe	87
PID 5592 wrote to memory of 1208	5592	6fd711c9c2d9499442df85e477e670c6.exe	87
PID 5592 wrote to memory of 100	5592	6fd711c9c2d9499442df85e477e670c6.exe	89
PID 5592 wrote to memory of 100	5592	6fd711c9c2d9499442df85e477e670c6.exe	89
PID 1208 wrote to memory of 220	1208	RAT_1.exe	90
PID 1208 wrote to memory of 220	1208	RAT_1.exe	90

C:\Users\Admin\AppData\Local\Temp\6fd711c9c2d9499442df85e477e670c6.exe
"C:\Users\Admin\AppData\Local\Temp\6fd711c9c2d9499442df85e477e670c6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Users\Admin\AppData\Roaming\RAT_1.exe
  "C:\Users\Admin\AppData\Roaming\RAT_1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:220
- C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe
  "C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\RAT_1.exe

Filesize
42KB

MD5
0548ede2f34ec15c359846ac21931736

SHA1
911b647552c40d5f445d197a12f44df5ba7d0d29

SHA256
c5a978f1fe0966b91ded36cfc3fbce334b563470649be530322bdc64c987fbfd

SHA512
845f9a501e4c53be653eb207415ec416540d21ab7ed45137eb6a39913167f1d3eaaf673071a109da8b0878b9c50c1be2ad1516009f59c1c4a43d3d26a7eec2ff

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe

Filesize
39KB

MD5
14d04ea681a8e090122dfffdfceb101d

SHA1
b45b87b183180f25955d50b880dccda72e60b321

SHA256
68694204f1b3473669202376319d85e62c0d3a8e58ab61df4b51a9150b067eca

SHA512
ec9b1fcb10ea11f0a4fff92fc1469640f2f512671e2212aebf88925f2504fb2fcab2dfc06092eb412d7e7fd1acd8c2242aea0fb323d887125f97da575ebbe91a

Download Submit
memory/100-21-0x0000000000F10000-0x0000000000F20000-memory.dmp

Filesize
64KB

Download
memory/100-23-0x00007FFFDC800000-0x00007FFFDD2C1000-memory.dmp

Filesize
10.8MB

Download
memory/100-24-0x00007FFFDC800000-0x00007FFFDD2C1000-memory.dmp

Filesize
10.8MB

Download
memory/100-25-0x00007FFFDC800000-0x00007FFFDD2C1000-memory.dmp

Filesize
10.8MB

Download
memory/5592-0-0x00007FFFDC803000-0x00007FFFDC805000-memory.dmp

Filesize
8KB

Download
memory/5592-1-0x0000000000E20000-0x0000000000E3E000-memory.dmp

Filesize
120KB

Download