xworm | ae790bbbadeb38db0e345970612a859e0b9888c976d798105a48a81ced48ff40

Resubmissions

28/03/2025, 07:19

250328-h5ykcss1bx10

28/03/2025, 07:15

250328-h29hfsvmy410

Analysis

max time kernel
102s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vanta Bundle/Vanta Loader.exe
Size 103KB
Sample250328-h5ykcss1bx
SHA256 9f3f1e2fb2144b98704d12094feec42ee6f17a12d934717cc2641bd22d711faa
MD5 7c55349ebd2e7a02bb00f3da322fe324
SHA1 b311a9f3bd9384b1f0670829f8542efe6ee36669
SHA512 80569369c223bef0617ddd72136a998eb05f3ff4185f093b714efa73f97452160e18b97112a5471469159caab6189a023aa5f51e0cb29a4b3a3eb5613d746e47
SSDEEP 3072:+J5RlYgEN4yo/UnboOAFxb+9E/mvi/SREt:ql5WE9mv+A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

documents-johnny.gl.at.ply.gg:63203:63203
documents-johnny.gl.at.ply.gg:63203

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral29/files/0x000600000002a782-7.dat	family_xworm
behavioral29/memory/780-17-0x0000000000780000-0x000000000079C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 1 IoCs

pid	Process
780	working.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1348	Vanta Loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	Vanta Loader.exe
Token: SeDebugPrivilege	780	working.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 780	1348	Vanta Loader.exe	78
PID 1348 wrote to memory of 780	1348	Vanta Loader.exe	78
PID 1348 wrote to memory of 2608	1348	Vanta Loader.exe	79
PID 1348 wrote to memory of 2608	1348	Vanta Loader.exe	79

C:\Users\Admin\AppData\Local\Temp\Vanta Bundle\Vanta Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Vanta Bundle\Vanta Loader.exe" bcdedit /c set shutdown /r readonly /f force /t 2
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\AppData\Roaming\working.exe
  "C:\Users\Admin\AppData\Roaming\working.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\gtag.bat" "
  2⤵
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gtag.bat

Path C:\Users\Admin\AppData\Roaming\gtag.bat
Size 1KB
SHA256 eca30211d1de347ebaea342504e17dd310363498d672e88645f118407e0f7795
MD5 b4d416c4dfceab87a7325ee4341699bb
SHA1 d7232afee2a44f312194d3354e9ddbdc6b3901f6
SHA512 d2cc348b0f1cb4b48f1ffa6278bc637c1a13e6ac4e1d344f31d12cc91e0d4662910cd0acf4d2aeee3077ccad33acf802c0d0edfaedaf900841ed0295371185fa
MD5 SHA1 SHA512

Submit Download

working.exe

Path C:\Users\Admin\AppData\Roaming\working.exe
Size 89KB
SHA256 50114e2d618e027638d413dd2fee7565c0baa212d70f2d9e2503ec65f4aa2b18
MD5 747791250e775bccfa4839fd5f35458a
SHA1 d819242314aadc30b403da6de7bc26ba6d0e8dc4
SHA512 66aeff5ab0b500e6804883cc004b2325c64b867b7eea937b34a9154d82aa154e1410601cf23c89cda89c4b7b0d86f5e1c7322b087706282fb0b5b1c33bf8f960
SSDEEP 1536:/nX0IBh4+RP/0iuOTpbzgQJowQzJm6NSXCObVuDtoza7AdIL:vxbzgHVgCObVaWzkJL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/780-20-0x00007FFF474B0000-0x00007FFF47F72000-memory.dmp

Download

memory/780-17-0x0000000000780000-0x000000000079C000-memory.dmp

Download

memory/780-23-0x00007FFF474B0000-0x00007FFF47F72000-memory.dmp

Download

memory/780-24-0x00007FFF474B0000-0x00007FFF47F72000-memory.dmp

Download

memory/1348-0-0x00007FFF474B3000-0x00007FFF474B5000-memory.dmp

Download

memory/1348-1-0x0000000000570000-0x0000000000590000-memory.dmp

Download

memory/1348-2-0x000000001B070000-0x000000001B090000-memory.dmp

Download

memory/1348-13-0x00007FFF474B0000-0x00007FFF47F72000-memory.dmp

Download

memory/1348-21-0x00007FFF474B0000-0x00007FFF47F72000-memory.dmp

Download