Analysis
-
max time kernel
64s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2025, 20:37
Behavioral task
behavioral1
Sample
XWorm V5.2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
XWorm V5.2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
XWorm V5.2.exe
-
Size
12.2MB
-
MD5
8b7b015c1ea809f5c6ade7269bdc5610
-
SHA1
c67d5d83ca18731d17f79529cfdb3d3dcad36b96
-
SHA256
7fc9c7002b65bc1b33f72e019ed1e82008cc7b8e5b8eaf73fc41a3e6a246980e
-
SHA512
e652913f73326f9d8461ac2a631e1e413719df28c7938b38949c005fda501d9e159554c3e17a0d5826d279bb81efdef394f7fb6ff7289cf296c19e92fd924180
-
SSDEEP
196608:pcWPW6SJ5POYAa23tuQUj7prczC9YNu+/ChWbPP91SDwDrZhd:pce0JtOSSLU3prczy0uqkaIkDtn
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4836 XWorm V5.2.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral2/memory/4836-1-0x00000260E6990000-0x00000260E75C8000-memory.dmp agile_net -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4836 XWorm V5.2.exe Token: SeDebugPrivilege 2712 taskmgr.exe Token: SeSystemProfilePrivilege 2712 taskmgr.exe Token: SeCreateGlobalPrivilege 2712 taskmgr.exe Token: 33 2712 taskmgr.exe Token: SeIncBasePriorityPrivilege 2712 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD52f1a50031dcf5c87d92e8b2491fdcea6
SHA171e2aaa2d1bb7dbe32a00e1d01d744830ecce08f
SHA25647578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed
SHA5121c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8