Analysis
- max time kernel
105s - max time network
106s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20250314-en - resource tags
- submitted
28/03/2025, 07:19
General
- Target Vanta Bundle/Vanta Loader.exe
- Size 103KB
- Sample250328-h5ykcss1bx
- SHA256 9f3f1e2fb2144b98704d12094feec42ee6f17a12d934717cc2641bd22d711faa
Malware Config
Extracted
-
xworm
-
documents-johnny.gl.at.ply.gg:63203:63203
-
documents-johnny.gl.at.ply.gg:63203
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vanta Bundle\Vanta Loader.exe"C:\Users\Admin\AppData\Local\Temp\Vanta Bundle\Vanta Loader.exe" bcdedit /c set shutdown /r readonly /f force /t 21⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\working.exe"C:\Users\Admin\AppData\Roaming\working.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\gtag.bat" "2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gtag.bat
working.exe
memory/2976-24-0x0000000000B10000-0x0000000000B2C000-memory.dmp
memory/2976-26-0x00007FFF188F0000-0x00007FFF193B2000-memory.dmp
memory/2976-29-0x00007FFF188F0000-0x00007FFF193B2000-memory.dmp
memory/2976-30-0x00007FFF188F0000-0x00007FFF193B2000-memory.dmp
memory/3996-1-0x0000000000D10000-0x0000000000D30000-memory.dmp
memory/3996-0-0x00007FFF188F3000-0x00007FFF188F5000-memory.dmp
memory/3996-2-0x00000000013E0000-0x0000000001400000-memory.dmp
memory/3996-4-0x00007FFF188F0000-0x00007FFF193B2000-memory.dmp
memory/3996-27-0x00007FFF188F0000-0x00007FFF193B2000-memory.dmp