3b2f28e621af3ea54abf28071e2f36143a30aa87a091f0ee3764c15b2dea4303

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 23:25

Target

XWorm V5.4 VIP.exe
Size

13.8MB
MD5

065a8d7fad2ad13b9f04de982294eb21
SHA1

7ecf3a3b1a0fa25f701787d98bd42c6f39c2f8ce
SHA256

3b2f28e621af3ea54abf28071e2f36143a30aa87a091f0ee3764c15b2dea4303
SHA512

0b828b1e545326258f46b7b0c535bfde1fff5ab4bf43bc729803a96e81f4b29a5d0e5a00e59ae392d517051dba37abd5f3b4dacc348242475cfa9e8cbfa16e34
SSDEEP

196608:msZttF81Wco24/vt8Kf67RQCTbJev4Z4t2WL8PSlsZA6G:mEtM1VR4cRZ0QZaL8qlsZVG

Score

7^/10

agilenet

Loads dropped DLL 1 IoCs

pid	Process
804	XWorm V5.4 VIP.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

resource	yara_rule
behavioral1/memory/804-1-0x00000000012B0000-0x0000000002090000-memory.dmp	agile_net

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	XWorm V5.4 VIP.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2984	804	XWorm V5.4 VIP.exe	30
PID 804 wrote to memory of 2984	804	XWorm V5.4 VIP.exe	30
PID 804 wrote to memory of 2984	804	XWorm V5.4 VIP.exe	30

C:\Users\Admin\AppData\Local\Temp\XWorm V5.4 VIP.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm V5.4 VIP.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 804 -s 672
  2⤵
  PID:2984

\Users\Admin\AppData\Local\Temp\ogpXG\ogpXG.dll

Filesize
112KB

MD5
2f1a50031dcf5c87d92e8b2491fdcea6

SHA1
71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

SHA256
47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

SHA512
1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

Download Submit
memory/804-0-0x000007FEF6133000-0x000007FEF6134000-memory.dmp

Filesize
4KB

Download
memory/804-1-0x00000000012B0000-0x0000000002090000-memory.dmp

Filesize
13.9MB

Download
memory/804-8-0x000007FEF6130000-0x000007FEF6B1C000-memory.dmp

Filesize
9.9MB

Download
memory/804-9-0x000000001D160000-0x000000001DD4E000-memory.dmp

Filesize
11.9MB

Download
memory/804-10-0x000007FEF6133000-0x000007FEF6134000-memory.dmp

Filesize
4KB

Download
memory/804-11-0x000007FEF6130000-0x000007FEF6B1C000-memory.dmp

Filesize
9.9MB

Download