| File name: | a.exe |
| Full analysis: | https://app.any.run/tasks/6d9a5e6d-495c-495f-84d9-647266ea2847 |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | December 02, 2023, 18:22:24 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows |
| MD5: | F4FDAC362F860520D28385D92C288A7C |
| SHA1: | 9D7ADD3EF8A94821EFF53B9F3B6634A204248A08 |
| SHA256: | BB86852CF19F43F30561B6DEB1F31735BEBE157FCECDC74F5B7BA453C253B367 |
| SSDEEP: | 1536:fBJlN4q5wQSFZBRpdEiWUdH7PjLSG/raJtVfNfsCZU8rzfBPRkRy4PwCYsfxX9:twQSFJjjba0ClXR2+sp |
MALICIOUS
Drops the executable file immediately after the start
- a.exe (PID: 1036)
XWORM has been detected (YARA)
- GV Client V4 BETA.exe (PID: 2308)
SUSPICIOUS
Reads the Internet Settings
- a.exe (PID: 1036)
- GV Client V4 BETA.exe (PID: 2308)
Starts POWERSHELL.EXE for commands execution
- a.exe (PID: 1036)
BASE64 encoded PowerShell command has been detected
- a.exe (PID: 1036)
Checks for external IP
- GV Client V4 BETA.exe (PID: 2308)
Base64-obfuscated command line is found
- a.exe (PID: 1036)
INFO
Checks supported languages
- a.exe (PID: 1036)
- GV Client V4 BETA.exe (PID: 2308)
Reads the computer name
- a.exe (PID: 1036)
- GV Client V4 BETA.exe (PID: 2308)
Reads Environment values
- GV Client V4 BETA.exe (PID: 2308)
Reads the machine GUID from the registry
- GV Client V4 BETA.exe (PID: 2308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
XWorm
(PID) Process(2308) GV Client V4 BETA.exe
C2goofyah-26004.portmap.host:26004
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameGV Client
Mutex3HiGdBXCdsu6ZZOm
TRiD
| .exe | | | Win64 Executable (generic) (61.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.6) |
| .exe | | | Win32 Executable (generic) (10) |
| .exe | | | Win16/32 Executable Delphi generic (4.6) |
| .exe | | | Generic Win/DOS Executable (4.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 0000:00:00 00:00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 2048 |
| InitializedDataSize: | 83968 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1499 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
42
Monitored processes
4
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1036 | "C:\Users\admin\AppData\Local\Temp\a.exe" | C:\Users\admin\AppData\Local\Temp\a.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 1584 | "C:\Users\admin\AppData\Local\Temp\a.exe" | C:\Users\admin\AppData\Local\Temp\a.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 2308 | "C:\Windows\GV Client V4 BETA.exe" | C:\Windows\GV Client V4 BETA.exe | a.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Exit code: 0 Version: 1.0.0.0 Modules
XWorm(PID) Process(2308) GV Client V4 BETA.exe C2goofyah-26004.portmap.host:26004 Keys AES<123456789> Options Splitter<Xwormmm> Sleep time3 USB drop nameGV Client Mutex3HiGdBXCdsu6ZZOm | |||||||||||||||
| 2784 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AYQBsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAcABkACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHcAagB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAYgBjACMAPgA=" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | a.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
Total events
1 830
Read events
1 809
Write events
21
Delete events
0
Modification events
| (PID) Process: | (1036) a.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (1036) a.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (1036) a.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (1036) a.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2784) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
Executable files
1
Suspicious files
3
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1036 | a.exe | C:\Windows\GV Client V4 BETA.exe | executable | |
MD5:687F761162C7F606147B6CB4EC53F1B0 | SHA256:B29FB89932C2A4B8C10A2BE6B5C0E5FCCBE6F4E9A5ECA3562983ACCD0B4D76C7 | |||
| 2784 | powershell.exe | C:\Users\admin\AppData\Local\Temp\znjkupuu.lsv.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 2784 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:637504105F7077E4FE8EF4F55B2DD0C1 | SHA256:1A049C496F2FD1BE3BF9543A0CD607ED94C8C6D765B7167FB86C1B0068E8E59D | |||
| 2784 | powershell.exe | C:\Users\admin\AppData\Local\Temp\mzigwpts.j32.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
1
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2308 | GV Client V4 BETA.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | text | 5 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1956 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
324 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
2308 | GV Client V4 BETA.exe | 208.95.112.1:80 | ip-api.com | TUT-AS | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
ip-api.com |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2308 | GV Client V4 BETA.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
2308 | GV Client V4 BETA.exe | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ip-api. com) |
2308 | GV Client V4 BETA.exe | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External Hosting Lookup by ip-api |
Process | Message |
|---|---|
GV Client V4 BETA.exe | CLR: Managed code called FailFast without specifying a reason.
|