Malware analysis SecuriteInfo.com.Win64.MalwareX-gen.25550.20765 Malicious activity

Add for printing

File name:	SecuriteInfo.com.Win64.MalwareX-gen.25550.20765
Full analysis:	https://app.any.run/tasks/72625d48-179f-4c7b-8936-02185110b1f4
Verdict:	Malicious activity
Threats:	XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. XWorm ist ein Remote Access Trojaner (RAT), der als Malware-as-a-Service verkauft wird. Er verfügt über ein umfangreiches Hacking-Toolset und ist in der Lage, private Informationen und Dateien auf dem infizierten Computer zu sammeln, MetaMask- und Telegram-Konten zu kapern und Benutzeraktivitäten zu verfolgen. XWorm wird in der Regel durch mehrstufige Angriffe auf die Computer der Opfer übertragen, die mit Phishing-E-Mails beginnen. Malware Trends Tracker >>>
Analysis date:	May 17, 2025, 05:01:06
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	auto generic crypto-regex remote xworm
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (GUI) x86-64, for MS Windows, 20 sections
MD5:	A9A67BC3C3B3B1D85F2C6F126B7604A5
SHA1:	A9E922E78403466F9B3C1D3C176CDA22AE433190
SHA256:	81997543956E55BE841EB355689D94756B835A44ED083D57C8B61DF05D762974
SSDEEP:	98304:RBObFJfAFxipQm+dqogLNLyDkehnbSyfcLfU07rk4mOzO0cfXujZKhL6ncXq7b8U:LQ2eV3McQmCG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- GENERIC has been found (auto)
  - SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe (PID: 7232)
  - vlc.exe (PID: 7320)
- XWORM has been detected (SURICATA)
  - explorer.exe (PID: 5492)
SUSPICIOUS
- Executable content was dropped or overwritten
  - SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe (PID: 7232)
  - vlc.exe (PID: 7320)
- Reads security settings of Internet Explorer
  - SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe (PID: 7232)
- Reads the date of Windows installation
  - SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe (PID: 7232)
- Connects to unusual port
  - explorer.exe (PID: 5492)
- Found regular expressions for crypto-addresses (YARA)
  - vlc.exe (PID: 7320)
- Contacting a server suspected of hosting an CnC
  - explorer.exe (PID: 5492)
INFO
- Checks supported languages
  - vlc.exe (PID: 7320)
  - SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe (PID: 7232)
- The sample compiled with english language support
  - SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe (PID: 7232)
  - vlc.exe (PID: 7320)
- Creates files in the program directory
  - vlc.exe (PID: 7320)
  - SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe (PID: 7232)
- Creates files or folders in the user directory
  - vlc.exe (PID: 7320)
- Reads the computer name
  - SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe (PID: 7232)
- Reads the software policy settings
  - slui.exe (PID: 7528)
- Process checks computer location settings
  - SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe (PID: 7232)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (87.3)
.exe	\|	Generic Win/DOS Executable (6.3)
.exe	\|	DOS Executable Generic (6.3)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2025:04:30 22:39:34+00:00
ImageFileCharacteristics:	Executable, No line numbers, Large address aware
PEType:	PE32+
LinkerVersion:	2.41
CodeSize:	762880
InitializedDataSize:	10038272
UninitializedDataSize:	3584
EntryPoint:	0x10ed
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	5.2
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

137

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

720

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

5492

C:\WINDOWS\Explorer.EXE

C:\Windows\explorer.exe

—

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Explorer

Version:

10.0.19041.3758 (WinBuild.160101.0800)

Modules

Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll

7232

"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe"

C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win64.malwarex-gen.25550.20765.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll

7320

"C:\ProgramData\XyleShield\vlc.exe"

C:\ProgramData\XyleShield\vlc.exe

SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe

User:

admin

Company:

VideoLAN

Integrity Level:

HIGH

Description:

VLC media player

Version:

3.0.21

Modules

Images
c:\programdata\xyleshield\vlc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

7496

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

7528

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msxml6.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\ondemandconnroutehelper.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\webio.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winnsi.dll

Add for printing

Total events

1 250

Read events

1 250

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7232	SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe	C:\ProgramData\XyleShield\libvlc.dll		executable
		MD5:264A9E0194DBD3C0540D67B156ECAABA	SHA256:095D164633AF53AC015DCD76540E8523744F57D506DB111F19B3FDD9D6180833
7232	SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe	C:\ProgramData\XyleShield\libvlccore.dll		executable
		MD5:1F76B1DF2D1F1B0C02C864A3ACAF04AB	SHA256:4FE971455D80831056DB2363354EA252113BDCB42C64F5E9E9602FD067DA214F
7232	SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe	C:\ProgramData\XyleShield\vlc.exe		executable
		MD5:F9538485432D3EC640F89096BA2D4D00	SHA256:5D695D8A0BB1D919CC77A2AA2488A61797BFA065238160278EE458120630AAF9
7232	SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe	C:\ProgramData\XyleShield\libcrypto-3-x64.dll		executable
		MD5:13C723D5668B0FAF2039238FA04D9634	SHA256:0761F0D83514334E9278D9BADDF06239F8E780DA3A28E35880C050EABEC87CD2
7232	SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe	C:\ProgramData\XyleShield\libwinpthread-1.dll		executable
		MD5:808A2BA82312143CDCF7A42CBFA3E13D	SHA256:D1E9581D6464427D0A15EBD5AE9199328AAB33CB119D122B57809659C065CDCA
7232	SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe	C:\ProgramData\XyleShield\libstdc++-6.dll		executable
		MD5:5D9253EEAC70FCF559278B4BC8286E04	SHA256:975B3727A607C8B06157537FF80C08BC9640891DDEA6510D368CF807B3339345
7232	SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe	C:\ProgramData\XyleShield\ConsoleApplication15.dll		executable
		MD5:26EFFB7076A4AE8A82383B934EED2023	SHA256:61EEDF98879F53C5ED67230C45B08F7D3595ECB175535ADBE864F4AD55DBF45F
7320	vlc.exe	C:\Users\admin\AppData\Roaming\vlcapp\libstdc++-6.dll		executable
		MD5:5D9253EEAC70FCF559278B4BC8286E04	SHA256:975B3727A607C8B06157537FF80C08BC9640891DDEA6510D368CF807B3339345
7320	vlc.exe	C:\Users\admin\AppData\Roaming\vlcapp\vlc.exe		executable
		MD5:F9538485432D3EC640F89096BA2D4D00	SHA256:5D695D8A0BB1D919CC77A2AA2488A61797BFA065238160278EE458120630AAF9
7232	SecuriteInfo.com.Win64.MalwareX-gen.25550.20765.exe	C:\ProgramData\XyleShield\libgcc_s_seh-1.dll		executable
		MD5:22FC85DB52A89E2E5B445BE4665D440E	SHA256:FC9636D3D17ED75BA4EC18299124F455C8B8CEC372C876AF932A724DB3417A56

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5496	MoUsoCoreWorker.exe	GET	200	23.219.150.101:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5496	MoUsoCoreWorker.exe	GET	200	2.19.11.120:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
6544	svchost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
8184	SIHClient.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
8184	SIHClient.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
4784	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5496	MoUsoCoreWorker.exe	2.19.11.120:80	crl.microsoft.com	Elisa Oyj	NL	whitelisted
5496	MoUsoCoreWorker.exe	23.219.150.101:80	www.microsoft.com	AKAMAI-AS	CL	whitelisted
2112	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	172.211.123.250:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
6544	svchost.exe	20.190.159.129:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6544	svchost.exe	2.17.190.73:80	ocsp.digicert.com	AKAMAI-AS	DE	whitelisted
2104	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 51.124.78.146	whitelisted
google.com	142.250.185.174	whitelisted
crl.microsoft.com	2.19.11.120 2.19.11.105	whitelisted
www.microsoft.com	23.219.150.101 23.35.229.160	whitelisted
client.wns.windows.com	172.211.123.250	whitelisted
login.live.com	20.190.159.129 20.190.159.73 40.126.31.73 20.190.159.2 40.126.31.69 20.190.159.68 40.126.31.71 20.190.159.4	whitelisted
ocsp.digicert.com	2.17.190.73	whitelisted
slscr.update.microsoft.com	4.175.87.197	whitelisted
fe3cr.delivery.mp.microsoft.com	52.165.164.15	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

Threats

PID	Process	Class	Message
5492	explorer.exe	Malware Command and Control Activity Detected	REMOTE [ANY.RUN] Xworm TCP Packet

Add for printing

No debug info

General Info

SecuriteInfo.com.Win64.MalwareX-gen.25550.20765

A9A67BC3C3B3B1D85F2C6F126B7604A5

A9E922E78403466F9B3C1D3C176CDA22AE433190

81997543956E55BE841EB355689D94756B835A44ED083D57C8B61DF05D762974

98304:RBObFJfAFxipQm+dqogLNLyDkehnbSyfcLfU07rk4mOzO0cfXujZKhL6ncXq7b8U:LQ2eV3McQmCG

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

GENERIC has been found (auto)

XWORM has been detected (SURICATA)

SUSPICIOUS

Executable content was dropped or overwritten

Reads security settings of Internet Explorer

Reads the date of Windows installation

Connects to unusual port

Found regular expressions for crypto-addresses (YARA)

Contacting a server suspected of hosting an CnC

INFO

Checks supported languages

The sample compiled with english language support

Creates files in the program directory

Creates files or folders in the user directory

Reads the computer name

Reads the software policy settings

Process checks computer location settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings