| URL: | https://public.db.files.1drv.com/y4m1jIPtcl0I5hZHp4G9Qllgr04MorEdLAhlK4pia49Ycf_Wv5kA66bNSjPmnL6NIqS3_upH3nhzJbyd0olFqOFTvwswAKx1swj-y8iYRzs5ZLgJgRpMTnO7Hryf77VlVWizJGYQyUeJmLkds1lO2jlRjbTHr6nFlkK4eDx-k6yBS2Vw4JEDna60cCCJjbkIkupyeIiCM3N5mihgXz-N-2jMXmmMs6Ov1qht2m-ZIPQkcY?AVOverride=1 |
| Full analysis: | https://app.any.run/tasks/79806fd6-cba1-4c52-a136-f3e17d6077d7 |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | February 15, 2024, 10:57:24 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 19ABD364BED5DF43D1D0EE23027F3F52 |
| SHA1: | 9D9AD95E67C45B13632D1883BA5CF42CEDCDC131 |
| SHA256: | 91FB8AD5C12A3CA0F2BEF342691CA2C2308FD6E3FDE9F07D6872075D4D7294BA |
| SSDEEP: | 6:2UpMwHo6KxtiLDaF0ujLSUN0k9XllfrEbuiq84xjsD6qlU:2UHKTiL+JjLSUNz5rEW84S+x |
MALICIOUS
Drops the executable file immediately after the start
- svchost.exe (PID: 764)
Create files in the Startup directory
- svchost.exe (PID: 764)
- svchost.exe (PID: 1520)
Changes the autorun value in the registry
- svchost.exe (PID: 764)
- svchost.exe (PID: 1520)
XWORM has been detected (YARA)
- svchost.exe (PID: 764)
XWORM has been detected (SURICATA)
- svchost.exe (PID: 764)
- svchost.exe (PID: 1520)
Connects to the CnC server
- svchost.exe (PID: 764)
- svchost.exe (PID: 1520)
SUSPICIOUS
The process creates files with name similar to system file names
- chrome.exe (PID: 2096)
- svchost.exe (PID: 764)
Executable content was dropped or overwritten
- svchost.exe (PID: 764)
Reads the Internet Settings
- svchost.exe (PID: 764)
- sipnotify.exe (PID: 1680)
- svchost.exe (PID: 1520)
Reads security settings of Internet Explorer
- svchost.exe (PID: 764)
- svchost.exe (PID: 1520)
The process executes via Task Scheduler
- svchost.exe (PID: 2936)
- sipnotify.exe (PID: 1680)
- svchost.exe (PID: 1604)
- ctfmon.exe (PID: 1584)
- svchost.exe (PID: 2600)
- svchost.exe (PID: 2772)
Connects to unusual port
- svchost.exe (PID: 764)
- svchost.exe (PID: 1520)
Reads settings of System Certificates
- sipnotify.exe (PID: 1680)
INFO
Executable content was dropped or overwritten
- chrome.exe (PID: 3672)
Checks supported languages
- svchost.exe (PID: 764)
- svchost.exe (PID: 2936)
- IMEKLMG.EXE (PID: 312)
- svchost.exe (PID: 1604)
- IMEKLMG.EXE (PID: 284)
- svchost.exe (PID: 1520)
- wmpnscfg.exe (PID: 2376)
- svchost.exe (PID: 1132)
- svchost.exe (PID: 2772)
- wmpnscfg.exe (PID: 2420)
- svchost.exe (PID: 2600)
Reads the computer name
- svchost.exe (PID: 764)
- svchost.exe (PID: 2936)
- IMEKLMG.EXE (PID: 284)
- svchost.exe (PID: 1604)
- IMEKLMG.EXE (PID: 312)
- svchost.exe (PID: 1520)
- svchost.exe (PID: 1132)
- wmpnscfg.exe (PID: 2376)
- wmpnscfg.exe (PID: 2420)
- svchost.exe (PID: 2600)
- svchost.exe (PID: 2772)
The process uses the downloaded file
- chrome.exe (PID: 2096)
- chrome.exe (PID: 3672)
Drops the executable file immediately after the start
- chrome.exe (PID: 3672)
Creates files or folders in the user directory
- svchost.exe (PID: 764)
Reads the machine GUID from the registry
- svchost.exe (PID: 764)
- svchost.exe (PID: 2936)
- svchost.exe (PID: 1604)
- svchost.exe (PID: 1132)
- svchost.exe (PID: 1520)
- svchost.exe (PID: 2600)
- svchost.exe (PID: 2772)
Manual execution by a user
- IMEKLMG.EXE (PID: 312)
- IMEKLMG.EXE (PID: 284)
- svchost.exe (PID: 1132)
- wmpnscfg.exe (PID: 2376)
- svchost.exe (PID: 1520)
- wmpnscfg.exe (PID: 2420)
Process checks whether UAC notifications are on
- IMEKLMG.EXE (PID: 284)
- IMEKLMG.EXE (PID: 312)
Application launched itself
- chrome.exe (PID: 3672)
Reads security settings of Internet Explorer
- sipnotify.exe (PID: 1680)
Reads the software policy settings
- sipnotify.exe (PID: 1680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
XWorm
(PID) Process(764) svchost.exe
C217.ip.gl.ply.gg:17088
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.2
MutexNzETq3LEvcoKErcd
Total processes
116
Monitored processes
31
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 124 | "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svchost" /tr "C:\Users\admin\AppData\Roaming\svchost.exe" | C:\Windows\System32\schtasks.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 284 | "C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /Log | C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Office IME 2010 Exit code: 1 Version: 14.0.4734.1000 Modules
| |||||||||||||||
| 296 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3848 --field-trial-handle=1164,i,15837202369721898156,630475010152115734,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 312 | "C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /Log | C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Office IME 2010 Exit code: 1 Version: 14.0.4734.1000 Modules
| |||||||||||||||
| 764 | "C:\Users\admin\Downloads\svchost.exe" | C:\Users\admin\Downloads\svchost.exe | chrome.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 1073807364 Version: 1.0.0.0 Modules
XWorm(PID) Process(764) svchost.exe C217.ip.gl.ply.gg:17088 Keys AES<123456789> Options Splitter<Xwormmm> Sleep time3 USB drop nameXWorm V5.2 MutexNzETq3LEvcoKErcd | |||||||||||||||
| 1112 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1212 --field-trial-handle=1164,i,15837202369721898156,630475010152115734,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1132 | "C:\Users\admin\AppData\Roaming\svchost.exe" | C:\Users\admin\AppData\Roaming\svchost.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1308 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=1060 --field-trial-handle=1164,i,15837202369721898156,630475010152115734,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1520 | "C:\Users\admin\AppData\Roaming\svchost.exe" | C:\Users\admin\AppData\Roaming\svchost.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1544 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=3676 --field-trial-handle=1164,i,15837202369721898156,630475010152115734,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
Total events
18 953
Read events
18 819
Write events
114
Delete events
20
Modification events
| (PID) Process: | (3672) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3672) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3672) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (3672) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3672) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3672) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3672) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (3672) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (3672) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (3672) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
Executable files
4
Suspicious files
26
Text files
50
Unknown types
14
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3672 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF17f0e8.TMP | — | |
MD5:— | SHA256:— | |||
| 3672 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3672 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat | binary | |
MD5:9C016064A1F864C8140915D77CF3389A | SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787 | |||
| 3672 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Variations | binary | |
MD5:961E3604F228B0D10541EBF921500C86 | SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED | |||
| 3672 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:358570F689377CE6838812643E03734B | SHA256:5B41FCC2E1A843AEAB9437B06E27B798870FF10D86A51B163BF48862BCD32590 | |||
| 3672 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:ECD3386BCC950E73B86EB128A5F57622 | SHA256:C9A068EAFBC587EDFC89392F64DDD350EEB96C5CF195CDB030BAB8F6DD33833B | |||
| 3672 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old~RF17f3f5.TMP | — | |
MD5:— | SHA256:— | |||
| 3672 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3672 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:9F941EA08DBDCA2EB3CFA1DBBBA6F5DC | SHA256:127F71DF0D2AD895D4F293E62284D85971AE047CA15F90B87BF6335898B0B655 | |||
| 3672 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF17f0f7.TMP | text | |
MD5:ADB669AB4CD1C63883C64FB0DBA2C7DA | SHA256:18BFF89047EC5B122573D089B3DC7A7DD14A5A7A515B2D8141584B41E723253F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
20
DNS requests
14
Threats
16
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1680 | sipnotify.exe | HEAD | 200 | 23.199.167.175:80 | http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133524683845620000 | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3672 | chrome.exe | 239.255.255.250:1900 | — | — | — | unknown |
3948 | chrome.exe | 74.125.71.84:443 | accounts.google.com | GOOGLE | US | unknown |
3948 | chrome.exe | 13.107.42.12:443 | public.db.files.1drv.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
3948 | chrome.exe | 142.250.184.206:443 | sb-ssl.google.com | GOOGLE | US | whitelisted |
3672 | chrome.exe | 224.0.0.251:5353 | — | — | — | unknown |
3948 | chrome.exe | 142.250.186.68:443 | www.google.com | GOOGLE | US | whitelisted |
3948 | chrome.exe | 142.250.186.110:443 | safebrowsing.google.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
accounts.google.com |
| shared |
public.db.files.1drv.com |
| whitelisted |
sb-ssl.google.com |
| whitelisted |
www.google.com |
| whitelisted |
safebrowsing.google.com |
| whitelisted |
17.ip.gl.ply.gg |
| malicious |
dns.msftncsi.com |
| shared |
query.prod.cms.rt.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
764 | svchost.exe | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] Xworm Network Packet |
15 ETPRO signatures available at the full report