General
-
Target
ada4045ee6399dc5733826a4d7e43a10.bin
-
Size
20KB
-
Sample
240630-dy9xlawhmn
-
MD5
13e2d8c8fc3ca74bcdaeed86ae2be0d3
-
SHA1
1af41a2635599d0b1194426969522d228f00781b
-
SHA256
6c5dd289cd2ec3345727cbe7430e50c7743596c5b1d258065e23c7a02865c1c4
-
SHA512
1524d3a3c398603edd727909c5f3eb7a59baa118802ea62c6abd4ea77c47101e65fe4dc07be55eac7da929d4fd044f1f6e4cf6199dd66c79b6483676f3c734b2
-
SSDEEP
384:dLwcl8Gi+Fy8m/nH2NdtfakTYAeKTuc6IDu36O+aTO25AR/tDmzv+zj3j+HL:ye8D+FsWztfzeM6Mu36Og2yZt6mfT+HL
Behavioral task
behavioral1
Sample
07ecf0ee68a52e1783da654389f5adaa861b5e7cfff04cbec504e721cc3a11ad.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
07ecf0ee68a52e1783da654389f5adaa861b5e7cfff04cbec504e721cc3a11ad.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
5.0
156.225.129.202:7000
lUhImY84qBJOkvuH
-
Install_directory
%AppData%
-
install_file
crss.exe
Targets
-
-
Target
07ecf0ee68a52e1783da654389f5adaa861b5e7cfff04cbec504e721cc3a11ad.exe
-
Size
41KB
-
MD5
ada4045ee6399dc5733826a4d7e43a10
-
SHA1
5184959ba1eb9034df44fb309be3781cee9a3d83
-
SHA256
07ecf0ee68a52e1783da654389f5adaa861b5e7cfff04cbec504e721cc3a11ad
-
SHA512
8987d6809bb5a8f9e94c35115d86cf9de6b1b3ee732e10338e38df33f2608954e6c5a61024ddcd7a833861aea0fd2aec94670aba529b73928031854fc39df1b0
-
SSDEEP
768:1KjSON6U+0VT7OWCCKUS0BMRjJF5Pa9pmA6vOwhy3/+zc:1gStUJVTa1nFrtF49AA6vOwg2o
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1