xworm | 894a461e0d709023ba6ec45f748b38a79ae12cf398702244ef2ffa93dd644133

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acfc2067aaf7bc306045845d1e965153.exe
Size

8.1MB
MD5

acfc2067aaf7bc306045845d1e965153
SHA1

6016abf24790dd789a439df8e7a3ae182b0c458f
SHA256

ea470bcf5b838073e39b2fcf27445025598f827f6f55d46dfc5097bae3423926
SHA512

1ff78a6e0b2b9cb210d6253de913176466ae79a327498c9a45490f9b82ca638a38be8f2cac08c46a8c848f5254705c1f46b0bc93c5d53049604fff9ebf47cb61
SSDEEP

196608:9+ocDHr9zPJzvIXZOXI7wHNnjlJ1KTfkryAz:KDRPxIXZqSwFxz2fkrF

Score

10^/10

xworm defense_evasion rat themida trojan

Malware Config

Extracted

Family

xworm

Version

5.0

ring-staffing.gl.at.ply.gg:32707

Mutex

elbD0YZaBQfsICaU

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral26/memory/5056-22-0x0000000000930000-0x0000000000940000-memory.dmp	family_xworm
behavioral26/files/0x000b000000024129-20.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ubDQ_protected.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ubDQ_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ubDQ_protected.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	acfc2067aaf7bc306045845d1e965153.exe

Executes dropped EXE 2 IoCs

pid	Process
5300	ubDQ_protected.exe
5056	Windows Session Manager.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral26/files/0x00050000000227be-8.dat	themida
behavioral26/memory/5300-21-0x0000000140000000-0x000000014091A000-memory.dmp	themida
behavioral26/memory/5300-25-0x0000000140000000-0x000000014091A000-memory.dmp	themida
behavioral26/memory/5300-26-0x0000000140000000-0x000000014091A000-memory.dmp	themida
behavioral26/memory/5300-30-0x0000000140000000-0x000000014091A000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ubDQ_protected.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5300	ubDQ_protected.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5056	Windows Session Manager.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 5300	5824	acfc2067aaf7bc306045845d1e965153.exe	87
PID 5824 wrote to memory of 5300	5824	acfc2067aaf7bc306045845d1e965153.exe	87
PID 5824 wrote to memory of 5056	5824	acfc2067aaf7bc306045845d1e965153.exe	89
PID 5824 wrote to memory of 5056	5824	acfc2067aaf7bc306045845d1e965153.exe	89
PID 5300 wrote to memory of 4580	5300	ubDQ_protected.exe	90
PID 5300 wrote to memory of 4580	5300	ubDQ_protected.exe	90
PID 4580 wrote to memory of 4672	4580	cmd.exe	91
PID 4580 wrote to memory of 4672	4580	cmd.exe	91
PID 5300 wrote to memory of 4744	5300	ubDQ_protected.exe	92
PID 5300 wrote to memory of 4744	5300	ubDQ_protected.exe	92

C:\Users\Admin\AppData\Local\Temp\acfc2067aaf7bc306045845d1e965153.exe
"C:\Users\Admin\AppData\Local\Temp\acfc2067aaf7bc306045845d1e965153.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Users\Admin\AppData\Roaming\ubDQ_protected.exe
  "C:\Users\Admin\AppData\Roaming\ubDQ_protected.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mode 70,30
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\system32\mode.com
      mode 70,30
      4⤵
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4744
- C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe
  "C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe

Filesize
39KB

MD5
14d04ea681a8e090122dfffdfceb101d

SHA1
b45b87b183180f25955d50b880dccda72e60b321

SHA256
68694204f1b3473669202376319d85e62c0d3a8e58ab61df4b51a9150b067eca

SHA512
ec9b1fcb10ea11f0a4fff92fc1469640f2f512671e2212aebf88925f2504fb2fcab2dfc06092eb412d7e7fd1acd8c2242aea0fb323d887125f97da575ebbe91a

Download Submit
C:\Users\Admin\AppData\Roaming\ubDQ_protected.exe

Filesize
8.1MB

MD5
cd79995102055c339f2283829b619877

SHA1
1532c21910d7f8899a91230be0cd709138f52de5

SHA256
57c21517194fe0617541686d48d51b835e9f77137b52803f0724cfa351c1ae9d

SHA512
6402f11d8377a60427fe0cbff6e0e01b8147cee512d889c4b6c6374dcf2b9eba8e7bdcfc2d1f2bb739ed47cd04e7748d2a8ea1d3df087aa94792be3df811470e

Download Submit
memory/5056-24-0x00007FFC19E20000-0x00007FFC1A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/5056-22-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/5056-27-0x00007FFC19E20000-0x00007FFC1A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/5056-28-0x000000001C560000-0x000000001C662000-memory.dmp

Filesize
1.0MB

Download
memory/5056-29-0x00007FFC19E20000-0x00007FFC1A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/5300-21-0x0000000140000000-0x000000014091A000-memory.dmp

Filesize
9.1MB

Download
memory/5300-25-0x0000000140000000-0x000000014091A000-memory.dmp

Filesize
9.1MB

Download
memory/5300-26-0x0000000140000000-0x000000014091A000-memory.dmp

Filesize
9.1MB

Download
memory/5300-30-0x0000000140000000-0x000000014091A000-memory.dmp

Filesize
9.1MB

Download
memory/5824-1-0x0000000000430000-0x0000000000C5A000-memory.dmp

Filesize
8.2MB

Download
memory/5824-0-0x00007FFC19E23000-0x00007FFC19E25000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads