xworm | bd7137c16c8c6c24e1bb91e9bc4cb6d03a7bff7bc52b7d334936af652829df67

Resubmissions

20/06/2026, 08:46

260620-kpgb9ad13l10

11/11/2025, 17:00

08/09/2025, 16:16

25/07/2025, 20:23

25/07/2025, 20:19

25/07/2025, 15:14

Analysis

user interaction
yes
max time kernel
43s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
RenameThis.exe
Size 162KB
Sample260620-kpgb9ad13l
SHA256 bd7137c16c8c6c24e1bb91e9bc4cb6d03a7bff7bc52b7d334936af652829df67
MD5 71535816b36c01751fa3875f602d848c
SHA1 fbacfc414c6b6faa20af774d44b3d6a834510338
SHA512 477c799b55d5d920437eb99f135d44af40cfcc00a221408fe67c8a9b791787c048064abece85036e82a2e4e2285940748a1e15c20e5f6c6e3b9138979d747a82
SSDEEP 3072:bN4CXhKMCM3OHeLbqVSovyfnE2Qt+DUfFtTiCIvViw2zhU:J4kQAOHevoYpQt+qt2CIUwM
TLSH
T14AF3E093BE337EB9C3E219FF148383549654EF00797E76BA1192A27851EB2C14D42F64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion evasion execution xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

survey-push.gl.at.ply.gg:32644

Mutex

ICJbl8xXmvGoLG6r

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c5ac-13.dat	family_xworm
behavioral2/memory/3744-20-0x0000000000770000-0x0000000000780000-memory.dmp	family_xworm

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Spoofer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2404	powershell.exe
6004	powershell.exe
2764	powershell.exe
4772	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5964	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	idk.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	idk.exe

Executes dropped EXE 4 IoCs

pid	Process
7032	Spoofer.exe
3744	idk.exe
4108	XWormClient.exe
6844	XWormClient.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3730367222-316663987-825798519-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Roaming\\XWormClient.exe"	idk.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Spoofer.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3730367222-316663987-825798519-1000\desktop.ini	Spoofer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Spoofer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.78cwli.crypt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.kapo1w.crypt	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll	Spoofer.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.f2xaqp.crypt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.gztt3i.crypt	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.g7unb0.crypt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.ks2vrn.crypt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.zwq9tz.crypt	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.gd637k.crypt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.kdc2qn.crypt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.9g9lc7.crypt	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	Spoofer.exe
File created	C:\Program Files\7-Zip\7z.exe.rvfvh0.crypt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.glm6ja.crypt	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.84vh62.crypt	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.n8xn5v.crypt	Spoofer.exe
File created	C:\Program Files\7-Zip\7zFM.exe.pesihu.crypt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.qg9sir.crypt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.a4mfqp.crypt	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.v1bsyw.crypt	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.awnru8.crypt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.91pkzy.crypt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	Spoofer.exe
File created	C:\Program Files\7-Zip\License.txt.ipkaqw.crypt	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.g98yjd.crypt	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.whhzwq.crypt	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.yrk2lx.crypt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.12pyhr.crypt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.811luk.crypt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.f8mugd.crypt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.x41ger.crypt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.10jcgg.crypt	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.63swcb.crypt	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.cvqtt7.crypt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.g6pp96.crypt	Spoofer.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.91k57e.crypt	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.vlnq8e.crypt	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	Spoofer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll	Spoofer.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.4p932n.crypt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	Spoofer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	Spoofer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
7032	Spoofer.exe
7032	Spoofer.exe
6004	powershell.exe
6004	powershell.exe
2764	powershell.exe
2764	powershell.exe
4772	powershell.exe
4772	powershell.exe
2404	powershell.exe
2404	powershell.exe
3744	idk.exe
7032	Spoofer.exe
7032	Spoofer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3744	idk.exe
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeIncreaseQuotaPrivilege	6004	powershell.exe
Token: SeSecurityPrivilege	6004	powershell.exe
Token: SeTakeOwnershipPrivilege	6004	powershell.exe
Token: SeLoadDriverPrivilege	6004	powershell.exe
Token: SeSystemProfilePrivilege	6004	powershell.exe
Token: SeSystemtimePrivilege	6004	powershell.exe
Token: SeProfSingleProcessPrivilege	6004	powershell.exe
Token: SeIncBasePriorityPrivilege	6004	powershell.exe
Token: SeCreatePagefilePrivilege	6004	powershell.exe
Token: SeBackupPrivilege	6004	powershell.exe
Token: SeRestorePrivilege	6004	powershell.exe
Token: SeShutdownPrivilege	6004	powershell.exe
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeSystemEnvironmentPrivilege	6004	powershell.exe
Token: SeRemoteShutdownPrivilege	6004	powershell.exe
Token: SeUndockPrivilege	6004	powershell.exe
Token: SeManageVolumePrivilege	6004	powershell.exe
Token: 33	6004	powershell.exe
Token: 34	6004	powershell.exe
Token: 35	6004	powershell.exe
Token: 36	6004	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeIncreaseQuotaPrivilege	2764	powershell.exe
Token: SeSecurityPrivilege	2764	powershell.exe
Token: SeTakeOwnershipPrivilege	2764	powershell.exe
Token: SeLoadDriverPrivilege	2764	powershell.exe
Token: SeSystemProfilePrivilege	2764	powershell.exe
Token: SeSystemtimePrivilege	2764	powershell.exe
Token: SeProfSingleProcessPrivilege	2764	powershell.exe
Token: SeIncBasePriorityPrivilege	2764	powershell.exe
Token: SeCreatePagefilePrivilege	2764	powershell.exe
Token: SeBackupPrivilege	2764	powershell.exe
Token: SeRestorePrivilege	2764	powershell.exe
Token: SeShutdownPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeSystemEnvironmentPrivilege	2764	powershell.exe
Token: SeRemoteShutdownPrivilege	2764	powershell.exe
Token: SeUndockPrivilege	2764	powershell.exe
Token: SeManageVolumePrivilege	2764	powershell.exe
Token: 33	2764	powershell.exe
Token: 34	2764	powershell.exe
Token: 35	2764	powershell.exe
Token: 36	2764	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeIncreaseQuotaPrivilege	4772	powershell.exe
Token: SeSecurityPrivilege	4772	powershell.exe
Token: SeTakeOwnershipPrivilege	4772	powershell.exe
Token: SeLoadDriverPrivilege	4772	powershell.exe
Token: SeSystemProfilePrivilege	4772	powershell.exe
Token: SeSystemtimePrivilege	4772	powershell.exe
Token: SeProfSingleProcessPrivilege	4772	powershell.exe
Token: SeIncBasePriorityPrivilege	4772	powershell.exe
Token: SeCreatePagefilePrivilege	4772	powershell.exe
Token: SeBackupPrivilege	4772	powershell.exe
Token: SeRestorePrivilege	4772	powershell.exe
Token: SeShutdownPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeSystemEnvironmentPrivilege	4772	powershell.exe
Token: SeRemoteShutdownPrivilege	4772	powershell.exe
Token: SeUndockPrivilege	4772	powershell.exe
Token: SeManageVolumePrivilege	4772	powershell.exe
Token: 33	4772	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3744	idk.exe
5144	LogonUI.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5512 wrote to memory of 7032	5512	RenameThis.exe	89
PID 5512 wrote to memory of 3744	5512	RenameThis.exe	91
PID 7032 wrote to memory of 5760	7032	Spoofer.exe	92
PID 5760 wrote to memory of 5964	5760	cmd.exe	93
PID 3744 wrote to memory of 6004	3744	idk.exe	94
PID 3744 wrote to memory of 2764	3744	idk.exe	97
PID 3744 wrote to memory of 4772	3744	idk.exe	99
PID 3744 wrote to memory of 2404	3744	idk.exe	101
PID 3744 wrote to memory of 1436	3744	idk.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RenameThis.exe
"C:\Users\Admin\AppData\Local\Temp\RenameThis.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5512
- C:\Users\Admin\AppData\Roaming\Spoofer.exe
  "C:\Users\Admin\AppData\Roaming\Spoofer.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:7032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5964
- C:\Users\Admin\AppData\Roaming\idk.exe
  "C:\Users\Admin\AppData\Roaming\idk.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\idk.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'idk.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2404
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1436

C:\Users\Admin\AppData\Roaming\XWormClient.exe
C:\Users\Admin\AppData\Roaming\XWormClient.exe
1⤵
- Executes dropped EXE
PID:4108

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
PID:6844

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a31855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ar.txt

Path C:\Program Files\7-Zip\Lang\ar.txt
Size 12KB
SHA256 28a604e8470e528b113f6e65fa03052f35f5b6d8c78298b2424d3601986c6be5
MD5 bf2f0d2c0139a8d5a9dbb1623b238da4
SHA1 c45586a8d083e7e838dee0da5f4e32dd5c3e5191
SHA512 2a3424647ee4bd04b31f73407026ae03aeada931a8a063ef09c140d656662fe16ebb96cc64f7c1cf2da7126fa28e9128df9de7a05ede482e473b7555d338d42a
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

ka.txt

Path C:\Program Files\7-Zip\Lang\ka.txt
Size 17KB
SHA256 a640eadfb443e38feee0004a7439327cb9f0a417588354a93d6d654c7847a406
MD5 aa33009cbf9d6b183187a991fce9a40e
SHA1 20c89488b25ad72949b6435a20ee5cca3d8b230a
SHA512 07319aa5019c7108edf3ceb8470d60c151820f2a85ebb1231c6f0c1d4cd696e51b6375e25a5357e1240f33c4f7b4ccff7df05a68dd46f755b31ca1664aeb9cc8
SSDEEP 3:RR5//:L5X
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 af1dcef2336a34935c52dd558f0eae4481a142d99b4d176f3b2552b28304c1ed
MD5 6046b8d661e5a61a26ea4106a535d5e9
SHA1 26d14f7dbdf98b0d59534c2056339c517ffb12cb
SHA512 adeea9f00b1567b93b9e5bf92ae60c4bbe0727f5af9f5fa7cd2d65ced330de4813ad57062ff07c54c241638467dc0add66dc92a9a6b38b8b6a3364a21ac5adb2
TLSH
T158216833F3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ea24e1f4c744f4a203318d786853d6650de07dd64e5e91381340937e12cd5b88
MD5 d77bdbc233fcec26f533058a70283a83
SHA1 a54825135c0dccd6ba8ff653537fff16b793a874
SHA512 c8e7c32ad58323e9919368bf89697ac6c2ed8f887336b616a285a02493cdeb3133493ec943f3b01d271491083ea4f5bcb799b67c9ac6ab8af3dddcc2b7829a4d
TLSH
T110216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0j41kcsy.g1c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0j41kcsy.g1c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Roaming\Spoofer.exe
Size 112KB
SHA256 da1c195bbcc4e5693af5119e8a9683ed0c4e8ea4258f1fdd60b821c2fcddf76d
MD5 22dc69076f5164b2db61e94616163b77
SHA1 5cb52db887824d287189ce5d3aee8decb670714e
SHA512 db247524c6503792386943c88b7d43e748a6b8c1fd4231fba600773e070651b245494e694b20181e584938530ab674f77e68c47977a21e56d7d16b79b3e80923
SSDEEP 1536:oqWwuKzSr37t9Pw1SZ31gnQ9Ptef9zyDxmPaj4w74z81EVvXDLDQ4Pg:oqEeSrnPTtGQ9Pyzy5j4w76/M4Pg
TLSH
T129B33B0AFB2A50BAC3A5D4B9CA834512DB727C498791A7CF13D09DD60E167E0AF3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idk.exe

Path C:\Users\Admin\AppData\Roaming\idk.exe
Size 39KB
SHA256 49594cfbf62272ae03a1d56a9aa095a9343cb981f6c4b633f705fcf2e1c076a0
MD5 79cc4e0b880a8d73c461f2a2240c37df
SHA1 97387fbe4ef599359bab95ee6727e5a6f931b91f
SHA512 ccd16edf7fc4306818d30ba0f7103d936931504030603255f121fabba4edddc5aa362365aac58c8cbf64aab55e3fe272449e929bfef04afb44f6dcbf6516800e
SSDEEP 768:J0LIQRRw9/QjHFKuu3amxHpufFWPr90XLT6POwh3aQ8:CL3fs/GHFKuu3am5EFS90XP6POwp2
TLSH
T166035B48BBD08221D9ED7BF559B3564B4B31F2039A13D74E4CE4829A1B676D48E803E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3744-20-0x0000000000770000-0x0000000000780000-memory.dmp

Download

memory/3744-23-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/3744-24-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/3744-25-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/3744-3114-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/3744-1819-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/3744-480-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/3744-453-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/3744-22-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/5512-21-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/5512-1-0x0000000000760000-0x000000000078E000-memory.dmp

Download

memory/5512-18-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/5512-3-0x00007FFE26EE0000-0x00007FFE27884000-memory.dmp

Download

memory/5512-0-0x00007FFE2706F000-0x00007FFE27070000-memory.dmp

Download

memory/6004-37-0x00000283734C0000-0x00000283734CA000-memory.dmp

Download

memory/6004-36-0x0000028373700000-0x00000283737B2000-memory.dmp

Download

memory/6004-35-0x00000283736E0000-0x00000283736FE000-memory.dmp

Download

memory/6004-28-0x00000283733F0000-0x0000028373412000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads