File name:

MelodysLowLatencyUI_v3.exe

Full analysis: https://app.any.run/tasks/cd8b302a-79fa-4f79-84ee-090495e527cb
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: November 20, 2023, 17:28:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
xworm
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

E1D569F00999E1C1ECA3634338E3E907

SHA1:

3CE8D18881C53D318081C8BB0BF1A4820E9BF1AE

SHA256:

65CCFB0EDE5AC70CF8EB2E3C6E4A3B32A8D775DDBA78DACBC508DB564BA3A14C

SSDEEP:

49152:AFUQd4wNmpX7Xz+vbiD9fZuG7JQxpQ9oRDjzUzcih9Ug+bzaFKOf8R6cV1N/zaMX:kUQd9NmpXjtn7wY47icDXbzP7RZz2MU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • MelodysLowLatencyUI_v3.exe (PID: 3428)
      • AntiVM.exe (PID: 3484)

    • Uses Task Scheduler to run other applications

      • AntiVM.exe (PID: 3484)

    • XWORM has been detected (YARA)

      • AntiVM.exe (PID: 3484)

    • XWORM has been detected (SURICATA)

      • AntiVM.exe (PID: 3484)

  • SUSPICIOUS

    • Reads the Internet Settings

      • MelodysLowLatencyUI_v3.exe (PID: 3428)
      • AntiVM.exe (PID: 3484)

    • Checks for external IP

      • AntiVM.exe (PID: 3484)

    • The process creates files with name similar to system file names

      • AntiVM.exe (PID: 3484)

    • Reads settings of System Certificates

      • AntiVM.exe (PID: 3484)

    • Connects to unusual port

      • AntiVM.exe (PID: 3484)

    • The process executes via Task Scheduler

      • svchost.exe (PID: 3736)

  • INFO

    • Reads the machine GUID from the registry

      • MelodysLowLatencyUI_v3.exe (PID: 3428)
      • AntiVM.exe (PID: 3484)
      • svchost.exe (PID: 3736)
      • wmpnscfg.exe (PID: 3884)

    • Checks supported languages

      • MelodysLowLatencyUI_v3.exe (PID: 3428)
      • AntiVM.exe (PID: 3484)
      • wmpnscfg.exe (PID: 3884)
      • svchost.exe (PID: 3736)

    • Reads the computer name

      • MelodysLowLatencyUI_v3.exe (PID: 3428)
      • AntiVM.exe (PID: 3484)
      • svchost.exe (PID: 3736)
      • wmpnscfg.exe (PID: 3884)

    • Creates files or folders in the user directory

      • MelodysLowLatencyUI_v3.exe (PID: 3428)
      • AntiVM.exe (PID: 3484)

    • Reads Environment values

      • AntiVM.exe (PID: 3484)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(3484) AntiVM.exe
C2https://pastebin.com/raw/wrHXjRMP:<123456789>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeXWorm V5.2
USB drop namesvchost.exe
MutexdHngoXL0mwBBZyY9
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:19 15:05:45+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 1241600
InitializedDataSize: 369152
UninitializedDataSize: -
EntryPoint: 0x13100e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Melody's Low Latency Software v3
CompanyName: Melody
FileDescription: Melody's Low Latency Software v3
FileVersion: 3.0.0.0
InternalName: MelodysLowLatencyUI_v3.exe
LegalCopyright: Copyright © Melody 2020
LegalTrademarks: Melody
OriginalFileName: MelodysLowLatencyUI_v3.exe
ProductName: Melody's Low Latency Software
ProductVersion: 3.0.0.0
AssemblyVersion: 3.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start melodyslowlatencyui_v3.exe no specs #XWORM antivm.exe schtasks.exe no specs wmpnscfg.exe no specs svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3428"C:\Users\admin\AppData\Local\Temp\MelodysLowLatencyUI_v3.exe" C:\Users\admin\AppData\Local\Temp\MelodysLowLatencyUI_v3.exe—explorer.exe
User:
admin
Company:
Melody
Integrity Level:
MEDIUM
Description:
Melody's Low Latency Software v3
Exit code:
0
Version:
3.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\melodyslowlatencyui_v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3484"C:\Users\admin\AppData\Roaming\AntiVM.exe" C:\Users\admin\AppData\Roaming\AntiVM.exe
MelodysLowLatencyUI_v3.exe
User:
admin
Company:
Kesentry Inc.
Integrity Level:
MEDIUM
Description:
Kezza Hub by Kezza Services
Exit code:
0
Version:
7.8.4.350
Modules
Images
c:\users\admin\appdata\roaming\antivm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
XWorm
(PID) Process(3484) AntiVM.exe
C2https://pastebin.com/raw/wrHXjRMP:<123456789>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeXWorm V5.2
USB drop namesvchost.exe
MutexdHngoXL0mwBBZyY9
3492"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svchost" /tr "C:\Users\admin\AppData\Local\svchost.exe"C:\Windows\System32\schtasks.exe—AntiVM.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3736C:\Users\admin\AppData\Local\svchost.exe C:\Users\admin\AppData\Local\svchost.exe—taskeng.exe
User:
admin
Company:
Kesentry Inc.
Integrity Level:
MEDIUM
Description:
Kezza Hub by Kezza Services
Exit code:
0
Version:
7.8.4.350
Modules
Images
c:\users\admin\appdata\local\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3884"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
4 245
Read events
4 214
Write events
28
Delete events
3

Modification events

(PID) Process:(3428) MelodysLowLatencyUI_v3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3428) MelodysLowLatencyUI_v3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3428) MelodysLowLatencyUI_v3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3428) MelodysLowLatencyUI_v3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3484) AntiVM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3484) AntiVM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3484) AntiVM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3484) AntiVM.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3484) AntiVM.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3884) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{6783B385-54E7-484B-9904-9178937BC570}\{8B52F30A-3B03-4542-A9F3-C99F128715A1}
Operation:delete keyName:(default)
Value:
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3428MelodysLowLatencyUI_v3.exeC:\Users\admin\AppData\Roaming\AntiVM.exeexecutable
MD5:8726E622B9B19AFC45A6EA2CA4134BEA
SHA256:86FB56E8CCABCD59AF6861F70877304D1BD18E80BA098AC56147393BDF69E63A
3484AntiVM.exeC:\Users\admin\AppData\Local\svchost.exeexecutable
MD5:8726E622B9B19AFC45A6EA2CA4134BEA
SHA256:86FB56E8CCABCD59AF6861F70877304D1BD18E80BA098AC56147393BDF69E63A
3428MelodysLowLatencyUI_v3.exeC:\Users\admin\AppData\Roaming\MelodysLowLatencyUI_v3.exeexecutable
MD5:3FF009A8D1F3704FA7B575E4E60001DF
SHA256:88890369A1E8A1390691279082340D8BFF5B24645DBF18738C8A1EDFA2DAF726
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
13
DNS requests
3
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3484
AntiVM.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
6 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3484
AntiVM.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
3484
AntiVM.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
3484
AntiVM.exe
18.158.249.75:16454
0.tcp.eu.ngrok.io
AMAZON-02
DE
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
pastebin.com
  • 172.67.34.170
  • 104.20.67.143
  • 104.20.68.143
shared
0.tcp.eu.ngrok.io
  • 18.158.249.75
malicious

Threats

PID
Process
Class
Message
3484
AntiVM.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
3484
AntiVM.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
3484
AntiVM.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1080
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
3484
AntiVM.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm
3484
AntiVM.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm
3484
AntiVM.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm
3484
AntiVM.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm
3484
AntiVM.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm
3484
AntiVM.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MelodysLowLatencyUI_v3.exe