xworm | 0c032c6a53e9bfeb4824f0988cf13e7ffc12aedce4ab8a1c4d4c8227bee9c5fb

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wizworm-v4-cleaned_Slayed.exe
Size 56KB
Sample261024-q3bltaas7x
SHA256 0c032c6a53e9bfeb4824f0988cf13e7ffc12aedce4ab8a1c4d4c8227bee9c5fb
MD5 94343d2dcaa2814033663d4be1b0e0d9
SHA1 07d8da2302a8404bdfbdfb554b8c70d7e739c9e8
SHA512 5b5b30e18b844edac277c80414bd5e032ab7f4885075a98b766ba0b32da1d33c5724ff0ab3d61d7fcba5f81c837a8dfa6bd14690f1895c3702533319c21c4d89
SSDEEP 768:TQcT9Rb4QJ9gyuYCB90xLwKPZ0csYdsWgBywubROWhbCQfOHqQ89loEps9:MWoQBu0pVPZ0c3dsWqybROWp9fV9ltE
TLSH
T1EA438E0CB7D14124D0FE97F40DB6A262EB78A6535507E36F3CD901ED2B23ADC8A506E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%AppData%

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1212-0-0x00000000006A0000-0x00000000006B4000-memory.dmp	family_xworm
behavioral2/files/0x000400000002a346-4.dat	family_xworm
behavioral2/memory/1212-7-0x00000000028B0000-0x00000000028C0000-memory.dmp	family_xworm

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wizworm-v4-cleaned_Slayed.lnk	wizworm-v4-cleaned_Slayed.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wizworm-v4-cleaned_Slayed.lnk	wizworm-v4-cleaned_Slayed.exe

Executes dropped EXE 3 IoCs

pid	Process
5456	wizworm-v4-cleaned_Slayed.exe
5324	wizworm-v4-cleaned_Slayed.exe
4976	wizworm-v4-cleaned_Slayed.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Windows\CurrentVersion\Run\wizworm-v4-cleaned_Slayed = "C:\\Users\\Admin\\AppData\\Roaming\\wizworm-v4-cleaned_Slayed.exe"	wizworm-v4-cleaned_Slayed.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wizworm-v4-cleaned_Slayed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wizworm-v4-cleaned_Slayed.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4536	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1212	wizworm-v4-cleaned_Slayed.exe
4684	chrome.exe
4684	chrome.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe
1212	wizworm-v4-cleaned_Slayed.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	wizworm-v4-cleaned_Slayed.exe
Token: SeDebugPrivilege	5456	wizworm-v4-cleaned_Slayed.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeDebugPrivilege	5324	wizworm-v4-cleaned_Slayed.exe
Token: SeDebugPrivilege	4976	wizworm-v4-cleaned_Slayed.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1212	wizworm-v4-cleaned_Slayed.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 5160	1212	wizworm-v4-cleaned_Slayed.exe	83
PID 4684 wrote to memory of 2520	4684	chrome.exe	87
PID 4684 wrote to memory of 2140	4684	chrome.exe	88
PID 4684 wrote to memory of 4536	4684	chrome.exe	89
PID 4684 wrote to memory of 2140	4684	chrome.exe	88
PID 4684 wrote to memory of 2304	4684	chrome.exe	91
PID 4684 wrote to memory of 2304	4684	chrome.exe	91
PID 4684 wrote to memory of 4048	4684	chrome.exe	92
PID 4684 wrote to memory of 4048	4684	chrome.exe	92
PID 4684 wrote to memory of 2436	4684	chrome.exe	93
PID 4684 wrote to memory of 2436	4684	chrome.exe	93
PID 4684 wrote to memory of 5384	4684	chrome.exe	96
PID 4684 wrote to memory of 5384	4684	chrome.exe	96
PID 4684 wrote to memory of 5920	4684	chrome.exe	97
PID 4684 wrote to memory of 4320	4684	chrome.exe	99
PID 4684 wrote to memory of 4320	4684	chrome.exe	99
PID 4684 wrote to memory of 4672	4684	chrome.exe	100
PID 4684 wrote to memory of 4672	4684	chrome.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\wizworm-v4-cleaned_Slayed.exe
"C:\Users\Admin\AppData\Local\Temp\wizworm-v4-cleaned_Slayed.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wizworm-v4-cleaned_Slayed" /tr "C:\Users\Admin\AppData\Roaming\wizworm-v4-cleaned_Slayed.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffe55f5c728,0x7ffe55f5c734,0x7ffe55f5c740
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,5260489944201132064,7501837210726160082,262144 --field-trial-handle=1972,i,2796870412905888471,14415306612397744093,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,3260509038948872108,1887650397456358958,524288 --field-trial-handle=1972,i,2796870412905888471,14415306612397744093,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,8093130501688548649,15597065684889545192,524288 --field-trial-handle=1972,i,2796870412905888471,14415306612397744093,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2392 /prefetch:13
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,7649203915383484406,12331779762792754842,2097152 --field-trial-handle=1972,i,2796870412905888471,14415306612397744093,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,5052215645969461192,7760830059512352930,2097152 --field-trial-handle=1972,i,2796870412905888471,14415306612397744093,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,8324366711870485141,6250941249784129520,2097152 --field-trial-handle=1972,i,2796870412905888471,14415306612397744093,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,10384596804238029912,8620181605943013868,524288 --field-trial-handle=1972,i,2796870412905888471,14415306612397744093,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5696,i,4315544602674925491,3785760358092652677,2097152 --field-trial-handle=1972,i,2796870412905888471,14415306612397744093,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4608,i,3769101754696419753,2529132993480816220,2097152 --field-trial-handle=1972,i,2796870412905888471,14415306612397744093,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2004

C:\Users\Admin\AppData\Roaming\wizworm-v4-cleaned_Slayed.exe
C:\Users\Admin\AppData\Roaming\wizworm-v4-cleaned_Slayed.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6056

C:\Users\Admin\AppData\Roaming\wizworm-v4-cleaned_Slayed.exe
C:\Users\Admin\AppData\Roaming\wizworm-v4-cleaned_Slayed.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Users\Admin\AppData\Roaming\wizworm-v4-cleaned_Slayed.exe
C:\Users\Admin\AppData\Roaming\wizworm-v4-cleaned_Slayed.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3677af7c-86d0-4828-962a-9c72447d7c35.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3677af7c-86d0-4828-962a-9c72447d7c35.tmp
Size 130KB
SHA256 cbb5243a9406be3d22526131af811a556c62ed0ba9055a13b5f40397f8f00ffb
MD5 0ee0be7984104787ebdc87bf9a34d7db
SHA1 fca2aedbfcb12ca1f178268384dda2dd96dbd051
SHA512 147371eda61fa617b93ef9674af612a17943c82d08dae4f5e0aef6cb48f62fae5013b97bb07fdee35305f232ea6fed93b9b82a26eca7c72f31d67b3c42c3c516
SSDEEP 3072:khgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:kxmX/B5UgKf2ne1utL1
TLSH
T146D302BE9DD9DFE36351B026A9A95B6EC9F67FC8A160DE4080F41085009F1FD4399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 7c6e2ff2cdb09e3d8d75fdb570270093f07e5e0a43f0e61e4fb2778ae54aada0
MD5 9a55c891d32d99029a871b7231664647
SHA1 0a7ff2067c1292bce3cf69e91bbbda26dc4c0914
SHA512 2293d8dcdd27570365aaf77fbb1762154f8de366d55bf8d4e8f69cec850d94e4067f4f80f018d02279ad49ea03ce6d1e9bbd226cb423dca66bd9a7c6b142c2ed
MD5 SHA1 SHA512

Submit Download

00b95c5f-9d57-4955-ae44-660654ce4e88.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\00b95c5f-9d57-4955-ae44-660654ce4e88.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

06471447-e1a5-493f-9268-6f473a6aea5f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\06471447-e1a5-493f-9268-6f473a6aea5f.tmp
Size 414B
SHA256 3d668f124196b2ac1727ae1724545b7d4f4221109023df2083634baca39f0501
MD5 31272c60d1d905995290ac686f119a07
SHA1 a2b53cd885d20438da5f7a160a02bd7b9fcfc981
SHA512 8f4eae9800633d729ec199a875ae047f73a80ef4bb630c56a240d976186de3fb48e67afb699d2034f6be3c158b088f1460132989b5bd19893ace18283d7ecb45
TLSH
T1AFE02BAEC861AC3715FC1F2995648746E74023562B518D4F7B3DC2084F72627558AD1C
MD5 SHA1 SHA512 TLSH

Submit Download

514277a0-1571-4f19-bb1c-d41309bca5fa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\514277a0-1571-4f19-bb1c-d41309bca5fa.tmp
Size 13KB
SHA256 cbcfbe27999bbf1c38c32cf734dbc58c0c74e8fb94cebfe52fc4ac99ec4b2c4e
MD5 2687abbcac7af17c0b616b501e486b1d
SHA1 baf57c5410325446dd74e61be138853be50fcccc
SHA512 d6063c76c0f9513dcd556327052394a8fbae929daff68178795f4017c88a3a038bc8b09526fadfd4132488a9d51a09e3cd9ab6243430667f2c455f48c796d43f
SSDEEP 384:3hjb67KxkXqKf/pUZNCgVLH2HfgslxwXODb++ErU3l6HGjOoAWI8n:3hb67KxkXqKf/pUZNCgVLH2HfgsP6OPJ
TLSH
T19152F867A84D9A7F0FD8C94DD8266F4FACB5015766680C6893FB5C0803E5BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d6ea8c4-4426-473a-b7c1-756476f6ea24.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8d6ea8c4-4426-473a-b7c1-756476f6ea24.tmp
Size 12KB
SHA256 bc4143fa5aba22297763e491593056046d2137629056acde24a15d945280acca
MD5 10e0ef6e327bac9d8fe1cc7b4c70fce7
SHA1 49b92aa484498ce89cae96ed0bce64bfb0e79080
SHA512 f2ef0de344d3bdcc287f971b6c3d568b88e2634619be6609e20df8a1d5c81934420819f0e24a2afc5ae71292c09addd6b1a9e12bfac0c59a11a76b6f0424bec6
SSDEEP 192:kRDSs3wv7+7pAPRp2EQPybY9ZHsb+WNmmjRbGU2AXvaoHhCPyIsnAUgtaJ:kRDSesS7UXcRbwnd20aoc8
TLSH
T16A42D72EED50797B5DEAC21AFD21B757D3F5102221912E84EAFC8D2C15D7ACD222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 46KB
SHA256 0839efec7a018929f7fdba2265279f923d03b3a28b792c0397e068f9ee4703fc
MD5 4c399a8faa65b59d08f1f01bf1a2e5fc
SHA1 b8a9ba2a1fc88425063e4ced71fc39fb6802e390
SHA512 55ec790c8a04d6a9601ec8cba93b347bc6e806b7f495ff370bb36e6c45c23e32b7d21f48b4c1a26c64b3f4b8f331a58103947c4c4267284cc7e5512429be1808
SSDEEP 768:RL/dxA3S3BG/XSAeJUy0t8vzih2x91QDaoWHxBJnlzPnlY2OaSKd1w+pINhN+lih:x/dxA3SRG/XNuUYzh5XZNlrnl7BLwrfT
TLSH
T1AF23027796135C9CF08E4FFAF122E3568FA0C8E09AFD90A306815DBE4B5B1198A10DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 36KB
SHA256 7666a2315579e131afdd82d1fe28e8c26b467dd07c32f63249429b2847e3b918
MD5 8e61c8400a09a701bf5f5bd456589fa7
SHA1 a0570d2cb7a5a3a1ed15e2bc8c786e014dc6ff3e
SHA512 2c76cc0bb965e630b8993707b987802ec0ed40ae32c201144ab245f32086f23dab4a580174eb67d0684093081bf6b8bd694d038fc86705db237851f8ac8618d6
SSDEEP 768:YCGjfMafchvz/RypycCFkNEqCX3iWqSB8DtTDu9U:YC8fc11Q6HvquO
TLSH
T176F2F174C5382BE0F9993230443541E7F8F0B2A59AFD972F859C79772A50033686F9D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 51KB
SHA256 321bf3074e8388a58920c20d80bb59fe29a9a616d39a12ce593ec8e77464967b
MD5 58ced124f99f3d96f2252fd5c4be03be
SHA1 f00bdc6d58a446f0183e29e40178b000377f9d14
SHA512 f1274fe9c054330871b2330f84d0c68bff08fbd77d9120dc46f4a114012f0e7173cd1d21d5a38c38650f5d1840c60eed805a0a8ee1107e13f5fbb65b2059fb15
SSDEEP 1536:fEdLjV7amWaQEMTVlNHU/ZQ8Ab/rr46Fv7:f6VOmYVlhU/2o6Fv7
TLSH
T17B3302CCC3813DDDE97B577EA4210D6D8E99C883E3158506F6BAAF6380921CEC9CC159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 45KB
SHA256 0626c516374a032ccbb31898b489cd22cb15766111ab6ef89827a61321ab9d43
MD5 90c0c46c5ea39861f0e4f2cb9fdc1728
SHA1 2203d554193267a86d1e736691bc5e346644f577
SHA512 975935b97221aa86460180975c2dbee5df49d3eeee3f1919526a4d8af6c3b6a0cd0e4de27a3809bc02e992e008c0fa7efb8fef18cadc4a1b57a57ef78af01d2b
SSDEEP 768:bnIhIr3B/CzXz7SGy9eFUipxkad5YP4mcup+MJT5C4esxaPwdlWGtV9yVaWfFt:bEIrcz7MoQzcup+MG4NxaPwiGP4Ft
TLSH
T16F2301976AE6FFAAD8DD3576327910EEEF41B0C2B7F5C65105048D6BC42E881CAC9148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 50KB
SHA256 a523dd692f42f4ef755ee5bed09a22b5a1e0699c386c61965fd84e156c4c68cd
MD5 f6bb70d5b2d6c8e0220a5cae031469d7
SHA1 6b00a5fa7af76413fc0f7be13da2030c3b36950f
SHA512 8fb9fe6c518ae5ccc3117ec959c1e3b11d947fb39de617597c3a072c2ad09ce25f525f7093ea3ce14c494ed5bb4e10c3da29054e2dacd5f54e3a1e35ee82b0b8
SSDEEP 1536:ut6DMpvowFDYyK92Rbp64Tjc9senWZY1TCS/sxSlmXH+:dMpvoXr9e8jseWy10xSlA+
TLSH
T156330256E580CD8EE6F0A07E09B5B38B3597EB8B77DC3551A760B09D9931280F87760C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 4f2407e0adde0a7c40e575f536480607384e796081b1d5fb488d579cfd95d7d3
MD5 cfb785e11044abc6992415c70d02fac0
SHA1 0ae1a673006d190dada8819799380578493fd5d0
SHA512 c14bb66396fa778483ea0e21d141972a2dc68d9497c60c188ed3a97fdf456678562cc8b38961fdceef2577977cbeec66f8b26294ffc7746654fd032fec7124fc
TLSH
T16611B178485065D3C737DB7214DC499972FB020F133FDEBED90296742099BD2BA560E9
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

61eba708-369e-4b62-aee0-0c91699bbbe1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\61eba708-369e-4b62-aee0-0c91699bbbe1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c629edb7-702f-44d7-be8c-6d8f064355ea.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c629edb7-702f-44d7-be8c-6d8f064355ea.tmp
Size 1012B
SHA256 4a92fe3a831ad42998d7c2590f720ddba5fe0380ec0c070303c8f3c213601c6e
MD5 5815e19f592ded2e3ce722975a9b1cdc
SHA1 9f9cc0c6f072138c0026e9cf327ba2fb57009a99
SHA512 731a4615ec6bd24f751d6bd8b9c83108206b4de4a50ff6c88fbfe2cac7ee5b45547ffe7b80a49f95f7fcc8ff23aae3b18cf85bad2495db29acdbbbc24ee4472b
TLSH
T114117BA7957EF82F603D49BB0E44FC095576A430414279F5DB6B82ADB1C15F71B02417
MD5 SHA1 SHA512 TLSH

Submit Download

ffa4aeab-90f7-4ea5-8a84-14bba5531d21.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ffa4aeab-90f7-4ea5-8a84-14bba5531d21.tmp
Size 6KB
SHA256 e9f6ea50be8f401f5cf0c8d179647eaffd5563d678761883e51afff5a6ea478c
MD5 b19369d8b3e04f8a90e0020cccdb541d
SHA1 256b5aaa993a6af720fe0ddd3fb8c85a76823006
SHA512 1e1669cd218583605ac03d8f5b4c5d1114758d708c8343cae3107ccbfb01e6a8cf8cf8772bac7e8bff2b7bcaee4258baef94eaf43caac072c9fc6f6a77e52f5d
SSDEEP 192:DqFgwnk6EgaInYhq2HHG8DnGCMGVcbzRIMwc:DqFgwnk6EgaInYhq2HHG8DnGCMGVcbzN
TLSH
T14AD1ADB7C3D49A6DC81166F4DA206D1BCE690D24532C3C67C8D6AE1B63E19B2E34174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4b81a50-976b-481b-9b16-c82474b7b46f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f4b81a50-976b-481b-9b16-c82474b7b46f.tmp
Size 11KB
SHA256 6137cd22f29aaf424ebc44776b508ba4e4280e3031ba42d43749ef66acbd94ef
MD5 b0f12bb6a1566507aa154e5c02015015
SHA1 dae7426c4a6d4fd07c886a3dbc93d9abcdae4a19
SHA512 fba3cdd11babbec3d8b1241f46296d3b37576abcd85c37e5317662634308136ea4426405cec5d42308b8cf2cbe7cd54916f1eadd7490331ea42038976fe57fcd
SSDEEP 192:kRqSs3Gv7+7pAPRp2R9ZHsb+WNnjR0mXvaoHh+VyIsnAUgtaJ:kRqSeyS7UXybw90Cao28
TLSH
T19E42D62DEE10793B5DEAC21AFD61B757D2F5102221952E84EAFC8D2C15D7ACD222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a93e50cf-3cfd-4079-9bc2-806552e85470.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a93e50cf-3cfd-4079-9bc2-806552e85470.tmp
Size 269KB
SHA256 2b46b47f15e214fc908eb197755de5f0a72e26e6479cb1cb58622ca3ee1bfb3f
MD5 634567269e1acaffb962db746edae8b3
SHA1 468c1b2d3960ec46cd4034cec2d41877c0472825
SHA512 294dfe97688e48c918b23a1c7e8f4a096e6cfcff65b250a79c0394925963c8796d4d8601911b40896fe86fb20c873583d3d187563638e1884edca1ea7a218e19
SSDEEP 6144:5HCsUfw5u7eC94LUX4rY7Q/CexmX/B5UgKf2ne1utLq:Is2w5Ee5Hra0Ow2npLq
TLSH
T14C4423FADFDE2E9737A4D12B752A170E4FBAAFD19444D98180F42047109E3F6C29A613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be767051-8376-42df-8bbf-0351adb82db5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\be767051-8376-42df-8bbf-0351adb82db5.tmp
Size 269KB
SHA256 1cee97715f6d699e6ff2a9b084d9f4bc7f87e9267c9ef250b5d0fc63f6248d0d
MD5 70c1280c379dd30ca4d31ac015610f76
SHA1 9dedb2e0936ae303fb2bf221a0b9ad2dcd111123
SHA512 78d2036325654b9e13dc7ba7753d43549e778b31f9a1f6d6e6c683a78b0311db4221298afdeadd5ef84acad27fe5e15950d50016e85e60c06e63afbd82a59bcb
SSDEEP 6144:6HCsUfw5u7eC94LUX4rY7Q/CexmX/B5UgKf2ne1utLq:5s2w5Ee5Hra0Ow2npLq
TLSH
T1054423FADFDE2E9737A4D12B752A170E4FBAAFD19444D98180F42047109E3F6C29A613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wizworm-v4-cleaned_Slayed.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wizworm-v4-cleaned_Slayed.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

wizworm-v4-cleaned_Slayed.exe

Path C:\Users\Admin\AppData\Roaming\wizworm-v4-cleaned_Slayed.exe
Size 56KB
SHA256 0c032c6a53e9bfeb4824f0988cf13e7ffc12aedce4ab8a1c4d4c8227bee9c5fb
MD5 94343d2dcaa2814033663d4be1b0e0d9
SHA1 07d8da2302a8404bdfbdfb554b8c70d7e739c9e8
SHA512 5b5b30e18b844edac277c80414bd5e032ab7f4885075a98b766ba0b32da1d33c5724ff0ab3d61d7fcba5f81c837a8dfa6bd14690f1895c3702533319c21c4d89
SSDEEP 768:TQcT9Rb4QJ9gyuYCB90xLwKPZ0csYdsWgBywubROWhbCQfOHqQ89loEps9:MWoQBu0pVPZ0c3dsWqybROWp9fV9ltE
TLSH
T1EA438E0CB7D14124D0FE97F40DB6A262EB78A6535507E36F3CD901ED2B23ADC8A506E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-0-0x00000000006A0000-0x00000000006B4000-memory.dmp

Download

memory/1212-7-0x00000000028B0000-0x00000000028C0000-memory.dmp

Download

memory/1212-54-0x00000000028B0000-0x00000000028C0000-memory.dmp

Download