graphworm | fa50c0eda132cebc0e28ba4a0157f9b66ec8b5e288c204dc4df911ae87734a40

Analysis

max time kernel
149s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa50c0eda132cebc0e28ba4a0157f9b66ec8b5e288c204dc4df911ae87734a40.exe
Size 1.3MB
Sample260604-stj8pshw7w
SHA256 fa50c0eda132cebc0e28ba4a0157f9b66ec8b5e288c204dc4df911ae87734a40
MD5 d09c4c7533e53632a38d635ffd43d91c
SHA1 f866ebc8fbdbb39876e30f8fea2694dacce28549
SHA512 3b8505a37a910fc7fd88f53095c470ca6f73857b8f58dfcea184f23d2d99ba72a0f11f79eefe93875a580b29aaca2a400a6fd3bb3c0a5bf4a4faf35943afd95f
SSDEEP 24576:nva3+u5s6inIUGs7BWv54O6RgJXNhx7XJ73T:nk2PnIIlWv54O6RgJXNhx7XJX
TLSH
T10F55C931EB00445AF9C2033369EC959D80957D318BDE40D3B2869DFA95AE3F26736A87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

webworm apt backdoor discovery graphworm

Malware Config

Signatures

Family: GraphWorm
GraphWorm is a Windows backdoor attributed to the China-aligned Webworm APT group.
backdoor graphworm

Detects GraphWorm 1 IoCs

apt webworm

resource	yara_rule
behavioral2/memory/3360-0-0x0000000000E20000-0x0000000001000000-memory.dmp	family_graphworm

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa50c0eda132cebc0e28ba4a0157f9b66ec8b5e288c204dc4df911ae87734a40.exe

C:\Users\Admin\AppData\Local\Temp\fa50c0eda132cebc0e28ba4a0157f9b66ec8b5e288c204dc4df911ae87734a40.exe
"C:\Users\Admin\AppData\Local\Temp\fa50c0eda132cebc0e28ba4a0157f9b66ec8b5e288c204dc4df911ae87734a40.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3360-0-0x0000000000E20000-0x0000000001000000-memory.dmp

Download