xworm | ae790bbbadeb38db0e345970612a859e0b9888c976d798105a48a81ced48ff40

Resubmissions

28/03/2025, 07:19

250328-h5ykcss1bx 10

28/03/2025, 07:15

250328-h29hfsvmy4 10

Analysis

max time kernel
105s
max time network
106s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
28/03/2025, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vanta Bundle/Vanta Loader.exe
Size

103KB
MD5

7c55349ebd2e7a02bb00f3da322fe324
SHA1

b311a9f3bd9384b1f0670829f8542efe6ee36669
SHA256

9f3f1e2fb2144b98704d12094feec42ee6f17a12d934717cc2641bd22d711faa
SHA512

80569369c223bef0617ddd72136a998eb05f3ff4185f093b714efa73f97452160e18b97112a5471469159caab6189a023aa5f51e0cb29a4b3a3eb5613d746e47
SSDEEP

3072:+J5RlYgEN4yo/UnboOAFxb+9E/mvi/SREt:ql5WE9mv+A

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

documents-johnny.gl.at.ply.gg:63203:63203

documents-johnny.gl.at.ply.gg:63203

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral28/files/0x000400000002696d-8.dat	family_xworm
behavioral28/memory/2976-24-0x0000000000B10000-0x0000000000B2C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	Vanta Loader.exe

Executes dropped EXE 1 IoCs

pid	Process
2976	working.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3996	Vanta Loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3996	Vanta Loader.exe
Token: SeDebugPrivilege	2976	working.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2976	3996	Vanta Loader.exe	83
PID 3996 wrote to memory of 2976	3996	Vanta Loader.exe	83
PID 3996 wrote to memory of 5668	3996	Vanta Loader.exe	84
PID 3996 wrote to memory of 5668	3996	Vanta Loader.exe	84

C:\Users\Admin\AppData\Local\Temp\Vanta Bundle\Vanta Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Vanta Bundle\Vanta Loader.exe" bcdedit /c set shutdown /r readonly /f force /t 2
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Roaming\working.exe
  "C:\Users\Admin\AppData\Roaming\working.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\gtag.bat" "
  2⤵
  PID:5668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\gtag.bat

Filesize
1KB

MD5
b4d416c4dfceab87a7325ee4341699bb

SHA1
d7232afee2a44f312194d3354e9ddbdc6b3901f6

SHA256
eca30211d1de347ebaea342504e17dd310363498d672e88645f118407e0f7795

SHA512
d2cc348b0f1cb4b48f1ffa6278bc637c1a13e6ac4e1d344f31d12cc91e0d4662910cd0acf4d2aeee3077ccad33acf802c0d0edfaedaf900841ed0295371185fa

Download Submit
C:\Users\Admin\AppData\Roaming\working.exe

Filesize
89KB

MD5
747791250e775bccfa4839fd5f35458a

SHA1
d819242314aadc30b403da6de7bc26ba6d0e8dc4

SHA256
50114e2d618e027638d413dd2fee7565c0baa212d70f2d9e2503ec65f4aa2b18

SHA512
66aeff5ab0b500e6804883cc004b2325c64b867b7eea937b34a9154d82aa154e1410601cf23c89cda89c4b7b0d86f5e1c7322b087706282fb0b5b1c33bf8f960

Download Submit
memory/2976-24-0x0000000000B10000-0x0000000000B2C000-memory.dmp

Filesize
112KB

Download
memory/2976-26-0x00007FFF188F0000-0x00007FFF193B2000-memory.dmp

Filesize
10.8MB

Download
memory/2976-29-0x00007FFF188F0000-0x00007FFF193B2000-memory.dmp

Filesize
10.8MB

Download
memory/2976-30-0x00007FFF188F0000-0x00007FFF193B2000-memory.dmp

Filesize
10.8MB

Download
memory/3996-1-0x0000000000D10000-0x0000000000D30000-memory.dmp

Filesize
128KB

Download
memory/3996-0-0x00007FFF188F3000-0x00007FFF188F5000-memory.dmp

Filesize
8KB

Download
memory/3996-2-0x00000000013E0000-0x0000000001400000-memory.dmp

Filesize
128KB

Download
memory/3996-4-0x00007FFF188F0000-0x00007FFF193B2000-memory.dmp

Filesize
10.8MB

Download
memory/3996-27-0x00007FFF188F0000-0x00007FFF193B2000-memory.dmp

Filesize
10.8MB

Download