General

  • Target
    kle8sa8p8x_Envio de resumen de actuaciones y documentos de soporte del procedimiento1765393663153.lzh
  • Size 5.8MB
  • Sample251215-v3arqsymcp
  • SHA256 9f6b7dd961e86b87ea95e0579485f40300adcba133bc5192657c730f8455fa3b
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\GrpcUtility_v12

  • inject_dll

    %windir%\SysWOW64\rasapi32.dll

xor.hex

Extracted

Family
  • xworm

Version
  • XWorm V7.0

C2
  • enviooooo.dynuddns.net:2815

Mutex
  • T5YY7vHarLue1lTX

Attributes
  • install_file

    USB.exe

aes.plain

Targets

    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/001_DEMANDA JUZGADO PENAL DE BOGOTA.exe
    • Size 5.6MB
    • SHA256 14d140999ab5d2ab903ddf1aedda4d868be68db054424c7fad70b8927b32a145
    • MD5 SHA1 SHA512 SSDEEP
    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Suspicious use of SetThreadContext

    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/HardwareLib.dll
    • Size 185KB
    • SHA256 4e5f1f42f90316819b9fe431722c5cc8c0a91d90e0fea87e580f17629e088a9a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/PluginHelper.dll
    • Size 134KB
    • SHA256 3b123f1fea7f38de527bca6dc51b9a922a7189a72441b48a39743063fb131148
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/PowerMgr.dll
    • Size 72KB
    • SHA256 1635647b6dcb4d58407e7be13b9aca60a34791752f20d7cff76ad769dbf4faec
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/Register.dll
    • Size 1.4MB
    • SHA256 0408ee9513a32d5c5c1495e2ee3dcf43f02533cea770ab1f07e1ab0167f4067b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/Scan.dll
    • Size 1002KB
    • SHA256 313778d51081f38feb3b9ea5279f941b4793291a1842306022d329242a57e0d7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/Temperature.dll
    • Size 173KB
    • SHA256 d987a17b4566602232353909027fa07ac5bf2c38f0613b24873e84fcc5e1d336
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/dataexchange.dll
    • Size 76KB
    • SHA256 13dd748913c226f4929af229f755230724adbba5ced7c11b83bc918f8294b5da
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/datastate.dll
    • Size 74KB
    • SHA256 6d33107ce562e7fa41a2cd7a48b4c8ab49cc5ee16af9fadcb65277cdca27c4e3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/libcrypto-1_1.dll
    • Size 1.7MB
    • SHA256 2cf28f824d1c452b63087a7434996c05e897c486a04299dd2d72ab8e9ff39a0a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/libssl-1_1.dll
    • Size 353KB
    • SHA256 fcc0e468e0ea8ee56231f5678e527c7d2312fcc5dfddd7fbeb71896206500b47
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/madBasic_.bpl
    • Size 209KB
    • SHA256 4b2e1c988a09e5b318c4dcdd51a25887d02bf48cbdef239b9cc86742459a50e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/madDisAsm_.bpl
    • Size 61KB
    • SHA256 3c930bbc232dc6e3c06b77a372431197ad31f4e75f2f68b9547fc29b015d9e49
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/madExcept_.bpl
    • Size 435KB
    • SHA256 f700ab8251ee590cb5a22e242bde3d8b7c62288278c0c051352ccc99b56ace4e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/rtl120.bpl
    • Size 1.1MB
    • SHA256 9d299887fb4a886be03f11a86af0d1021a2331ab0283c90ba6d790fa366d3767
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS/sdassist.dll
    • Size 201KB
    • SHA256 4a79ad74e70700b8db6bf101023d70fcd5b1b28f0e28584ee93610a873263995
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10

MITRE ATT&CK Enterprise v16

Tasks

static1

hijackloader
Score
10/10

behavioral1

discoveryxwormrattrojan
Score
10/10

behavioral2

discoveryxwormrattrojan
Score
10/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10