Overview
overview
10Static
static
10XWorm V5.6...io.dll
windows7-x64
1XWorm V5.6...io.dll
windows10-2004-x64
1XWorm V5.6...on.dll
windows7-x64
1XWorm V5.6...on.dll
windows10-2004-x64
1XWorm V5.6...ws.dll
windows7-x64
1XWorm V5.6...ws.dll
windows10-2004-x64
1XWorm V5.6...at.dll
windows7-x64
1XWorm V5.6...at.dll
windows10-2004-x64
1XWorm V5.6...um.dll
windows7-x64
1XWorm V5.6...um.dll
windows10-2004-x64
1XWorm V5.6...rd.dll
windows7-x64
1XWorm V5.6...rd.dll
windows10-2004-x64
1XWorm V5.6...ss.dll
windows7-x64
1XWorm V5.6...ss.dll
windows10-2004-x64
1XWorm V5.6...er.dll
windows7-x64
1XWorm V5.6...er.dll
windows10-2004-x64
1XWorm V5.6...er.dll
windows7-x64
1XWorm V5.6...er.dll
windows10-2004-x64
1XWorm V5.6...er.dll
windows7-x64
1XWorm V5.6...er.dll
windows10-2004-x64
1XWorm V5.6...DP.dll
windows7-x64
1XWorm V5.6...DP.dll
windows10-2004-x64
1XWorm V5.6...NC.dll
windows7-x64
1XWorm V5.6...NC.dll
windows10-2004-x64
1XWorm V5.6...ry.dll
windows7-x64
1XWorm V5.6...ry.dll
windows10-2004-x64
1XWorm V5.6...ps.dll
windows7-x64
1XWorm V5.6...ps.dll
windows10-2004-x64
1XWorm V5.6...ns.dll
windows7-x64
1XWorm V5.6...ns.dll
windows10-2004-x64
1XWorm V5.6...er.dll
windows7-x64
1XWorm V5.6...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 15:37
Behavioral task
behavioral1
Sample
XWorm V5.6/XWorm V5.6/NAudio.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
XWorm V5.6/XWorm V5.6/NAudio.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
XWorm V5.6/XWorm V5.6/Newtonsoft.Json.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
XWorm V5.6/XWorm V5.6/Newtonsoft.Json.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
XWorm V5.6/XWorm V5.6/Plugins/ActiveWindows.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
XWorm V5.6/XWorm V5.6/Plugins/ActiveWindows.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
XWorm V5.6/XWorm V5.6/Plugins/Chat.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
XWorm V5.6/XWorm V5.6/Plugins/Chat.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
XWorm V5.6/XWorm V5.6/Plugins/Chromium.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
XWorm V5.6/XWorm V5.6/Plugins/Chromium.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
XWorm V5.6/XWorm V5.6/Plugins/Clipboard.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
XWorm V5.6/XWorm V5.6/Plugins/Clipboard.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
XWorm V5.6/XWorm V5.6/Plugins/Cmstp-Bypass.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
XWorm V5.6/XWorm V5.6/Plugins/Cmstp-Bypass.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
XWorm V5.6/XWorm V5.6/Plugins/FileManager.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
XWorm V5.6/XWorm V5.6/Plugins/FileManager.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
XWorm V5.6/XWorm V5.6/Plugins/FilesSearcher.dll
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
XWorm V5.6/XWorm V5.6/Plugins/FilesSearcher.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
XWorm V5.6/XWorm V5.6/Plugins/HBrowser.dll
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
XWorm V5.6/XWorm V5.6/Plugins/HBrowser.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
XWorm V5.6/XWorm V5.6/Plugins/HRDP.dll
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
XWorm V5.6/XWorm V5.6/Plugins/HRDP.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
XWorm V5.6/XWorm V5.6/Plugins/HVNC.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
XWorm V5.6/XWorm V5.6/Plugins/HVNC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
XWorm V5.6/XWorm V5.6/Plugins/HVNCMemory.dll
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
XWorm V5.6/XWorm V5.6/Plugins/HVNCMemory.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
XWorm V5.6/XWorm V5.6/Plugins/HiddenApps.dll
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
XWorm V5.6/XWorm V5.6/Plugins/HiddenApps.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
XWorm V5.6/XWorm V5.6/Plugins/Informations.dll
Resource
win7-20240419-en
Behavioral task
behavioral30
Sample
XWorm V5.6/XWorm V5.6/Plugins/Informations.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
XWorm V5.6/XWorm V5.6/Plugins/Keylogger.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
XWorm V5.6/XWorm V5.6/Plugins/Keylogger.dll
Resource
win10v2004-20240508-en
General
-
Target
XWorm V5.6/XWorm V5.6/Plugins/Chromium.dll
-
Size
32KB
-
MD5
edb2f0d0eb08dcd78b3ddf87a847de01
-
SHA1
cc23d101f917cad3664f8c1fa0788a89e03a669c
-
SHA256
b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982
-
SHA512
8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3
-
SSDEEP
768:6SyQlmUmBlEu0FXfjq2sgDrLjfcVJ5sN9aWdMIxbKhJ+GEq3ZsL5f62:3yQltmBlmFXfjq2sgDrLjfcVJ5sNkQOa
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
taskmgr.exepid process 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 2376 taskmgr.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
Processes:
taskmgr.exepid process 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
Processes:
taskmgr.exepid process 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe 2376 taskmgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\XWorm V5.6\XWorm V5.6\Plugins\Chromium.dll",#11⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2376-0-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB