violetworm | b1cc5ad78b72d2f0a94d370e840e24ea38a31690ece3af851da345975da7ca5c

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 277KB
Sample261016-dvb66a1t5n
SHA256 b1cc5ad78b72d2f0a94d370e840e24ea38a31690ece3af851da345975da7ca5c
MD5 bd43519650bf3de09d993e9f01560a78
SHA1 0babeadf546eee56b56c6054bd9fee28372c7411
SHA512 47b5f8aceff56db33c853b6aca123228a0bed9031175bce1e86bf92e2ef707184c511a7a882d4acdc4048f374f682faf379206a6e3c749f9fd7b4c3eaebcc4c6
SSDEEP 3072:YAIg/QxeUMj14glS/FY1uEresLmg69bGWJ3v3sZUBoBFhnPd+h7BOWXw7xI2wllc:AGSlMOVdYtep9btJ3vsmAru7hwymTY
TLSH
T19454B610F9E58299F0B75B71CBD978FA56ADF6B2AF06522940CD23020E335B1EDD3426
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution violetworm persistence privilege_escalation worm

Malware Config

Extracted

Family

violetworm

38.180.236.154:700

Attributes

build_id
a25ede43f76413baa0dd21d7a01afdbd94b48c335854de3e3346d6e751297990
splitter
<Violet>

aes.plain

Signatures

Family: VioletWorm
VioletWorm is a Windows worm written in C#.
worm violetworm

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe	file.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe	file.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe	svchost.exe

Executes dropped EXE 13 IoCs

pid	Process
4812	svchost.exe
3900	file.exe
6068	file.exe
508	file.exe
4980	file.exe
5868	file.exe
3628	file.exe
3060	file.exe
1276	file.exe
5836	file.exe
720	file.exe
5892	file.exe
760	file.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe"	file.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	file.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	file.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2440	schtasks.exe
2108	schtasks.exe
5332	schtasks.exe
3224	schtasks.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4288	file.exe
Token: SeDebugPrivilege	4812	svchost.exe
Token: SeDebugPrivilege	3900	file.exe
Token: SeDebugPrivilege	6068	file.exe
Token: SeDebugPrivilege	508	file.exe
Token: SeDebugPrivilege	4980	file.exe
Token: SeDebugPrivilege	5868	file.exe
Token: SeDebugPrivilege	3628	file.exe
Token: SeDebugPrivilege	3060	file.exe
Token: SeDebugPrivilege	1276	file.exe
Token: SeDebugPrivilege	5836	file.exe
Token: SeDebugPrivilege	720	file.exe
Token: SeDebugPrivilege	5892	file.exe
Token: SeDebugPrivilege	760	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 2440	4288	file.exe	89
PID 4288 wrote to memory of 2108	4288	file.exe	91
PID 4288 wrote to memory of 5332	4288	file.exe	93
PID 4288 wrote to memory of 3224	4288	file.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "WhatsAppUpdate" /tr "C:\Users\Admin\AppData\Roaming\file.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2440
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "SlackUpdate" /tr "C:\Users\Admin\AppData\Local\file.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2108
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "AMDUpdate" /tr "C:\ProgramData\file.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5332
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /f /sc minute /mo 1 /tn "LogiUpdate" /tr "C:\Windows\Temp\file.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3224

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Users\Admin\AppData\Roaming\file.exe
C:\Users\Admin\AppData\Roaming\file.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3900

C:\Windows\Temp\file.exe
C:\Windows\Temp\file.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Users\Admin\AppData\Local\file.exe
C:\Users\Admin\AppData\Local\file.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:508

C:\ProgramData\file.exe
C:\ProgramData\file.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Users\Admin\AppData\Roaming\file.exe
"C:\Users\Admin\AppData\Roaming\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Users\Admin\AppData\Local\file.exe
"C:\Users\Admin\AppData\Local\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\ProgramData\file.exe
"C:\ProgramData\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\Temp\file.exe
"C:\Windows\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Users\Admin\AppData\Roaming\file.exe
"C:\Users\Admin\AppData\Roaming\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Users\Admin\AppData\Local\file.exe
"C:\Users\Admin\AppData\Local\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:720

C:\ProgramData\file.exe
"C:\ProgramData\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Windows\Temp\file.exe
"C:\Windows\Temp\file.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

file.exe

Path C:\Users\Admin\AppData\Roaming\file.exe
Size 277KB
SHA256 b1cc5ad78b72d2f0a94d370e840e24ea38a31690ece3af851da345975da7ca5c
MD5 bd43519650bf3de09d993e9f01560a78
SHA1 0babeadf546eee56b56c6054bd9fee28372c7411
SHA512 47b5f8aceff56db33c853b6aca123228a0bed9031175bce1e86bf92e2ef707184c511a7a882d4acdc4048f374f682faf379206a6e3c749f9fd7b4c3eaebcc4c6
SSDEEP 3072:YAIg/QxeUMj14glS/FY1uEresLmg69bGWJ3v3sZUBoBFhnPd+h7BOWXw7xI2wllc:AGSlMOVdYtep9btJ3vsmAru7hwymTY
TLSH
T19454B610F9E58299F0B75B71CBD978FA56ADF6B2AF06522940CD23020E335B1EDD3426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4288-0-0x00007FFD0834F000-0x00007FFD08350000-memory.dmp

Download

memory/4288-1-0x0000000000D20000-0x0000000000D6A000-memory.dmp

Download

memory/4288-2-0x00007FFD081C0000-0x00007FFD08B64000-memory.dmp

Download

memory/4288-3-0x00007FFD081C0000-0x00007FFD08B64000-memory.dmp

Download

memory/4288-4-0x00007FFD081C0000-0x00007FFD08B64000-memory.dmp

Download

memory/4288-5-0x00007FFD081C0000-0x00007FFD08B64000-memory.dmp

Download

memory/4288-6-0x00007FFD081C0000-0x00007FFD08B64000-memory.dmp

Download

memory/4288-7-0x00007FFD081C0000-0x00007FFD08B64000-memory.dmp

Download

memory/4288-8-0x00007FFD081C0000-0x00007FFD08B64000-memory.dmp

Download

memory/4288-14-0x00007FFD081C0000-0x00007FFD08B64000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads