xworm | c32914aace819b46c2aab0a5840ef955e5a8cabe05e91f8e79bf0884bd8c7a12

General

Target
c32914aace819b46c2aab0a5840ef955e5a8cabe05e91f8e79bf0884bd8c7a12.zip
Size 1.2MB
Sample260505-e5krqacv2p
SHA256 c32914aace819b46c2aab0a5840ef955e5a8cabe05e91f8e79bf0884bd8c7a12
MD5 2bdb7ff7257ffcfdf351e7a615fe0f9a
SHA1 89f1e10fe0ecef28f91954ee7befb73a311b06b3
SHA512 9ac4dd5b77104a8dbe6464105b2e5a2f9fcf6f09625baa336655cd8768814d801ca6bbcfc17b0e05e0db37d5bb08e637a880f9d9427e15d40b6f9c98ade20ec9
SSDEEP 24576:kOqO+KeBujjXvjteQ5FWJJoP5YSWOy0srcfctsLuD0LpQ8X6mJWM9UHdDoWpVq:LjaujjXvjtRgnykgD6WNC9Dm
TLSH
T1A95533D1BE91AFA771E12E6C502DDA5337A0A7E1EE107C6683C9153ADB005D8D8C36F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

107.173.143.20:7004

Mutex

SyYYqdoljYBl4one

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  PO-1404-T-268-pdf.exe
- Size 1.8MB
- SHA256 bc84425e91709166a5dfbd93ace6b3ad24db1eae82da1b78282b55de277e3482
- MD5 b9239601ac905789220113c273d15699
- SHA1 3e9acbe6cd8d9986d95e2686e0dd16392a70d624
- SHA512 d3114e5b16dddc95a9058d1ca2fdfa7d2db36c1ede85acb0ebeb474af56868bdd4ab1d62f3b2d89dc9c7c674c3800fe83cf6da6b5638071ceca691eb4f1c82fc
- SSDEEP 24576:DCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrPOAas1cNUtwLID0Lpu8XcWJ8Y9ivd1:01H4jR2TYrQbDTrPuO4FcmZMlp
- TLSH
  T15B85CF0573A442DDFEABE1768A13C507C7B1BC450637861F06A4BA766F33B716A2E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Suspicious use of NtCreateUserProcessOtherParentProcess

Checks computer location settings

Drops startup file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2