| File name: | YWX1.zip |
| Full analysis: | https://app.any.run/tasks/fa391fc0-f898-439f-abc3-de3ceaa2f1af |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | October 19, 2024, 05:23:26 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| MD5: | BEE7220171DCD5DE3D6DFEDA91ACF874 |
| SHA1: | 5DC7861C6197D923FD86CDEE25BAB51F6322208A |
| SHA256: | BDCA32AD20014D0F174F28FE7FE10B804CA4CADB005E05A7880A1CF4B9ADCA78 |
| SSDEEP: | 24576:k6ThwMQ7GAUHmvkc37r5Q+hUOeatQjW9Ds0rfcrve2Q:k6ThwMsGAUHmvkc37r5Q+hUOeatQjW99 |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 6668)
Create files in the Startup directory
- pteropod.exe (PID: 3964)
XWORM has been detected (YARA)
- RegSvcs.exe (PID: 6200)
Connects to the CnC server
- RegSvcs.exe (PID: 6200)
XWORM has been detected (SURICATA)
- RegSvcs.exe (PID: 6200)
SUSPICIOUS
Executable content was dropped or overwritten
- RFQ_NO 00873609_VL103659-PR10465_Order.exe (PID: 2928)
Starts itself from another location
- RFQ_NO 00873609_VL103659-PR10465_Order.exe (PID: 2928)
Connects to unusual port
- RegSvcs.exe (PID: 6200)
Contacting a server suspected of hosting an CnC
- RegSvcs.exe (PID: 6200)
INFO
Reads mouse settings
- RFQ_NO 00873609_VL103659-PR10465_Order.exe (PID: 2928)
- pteropod.exe (PID: 3964)
The process uses the downloaded file
- WinRAR.exe (PID: 4232)
- WinRAR.exe (PID: 6668)
Create files in a temporary directory
- RFQ_NO 00873609_VL103659-PR10465_Order.exe (PID: 2928)
- pteropod.exe (PID: 3964)
Checks supported languages
- RFQ_NO 00873609_VL103659-PR10465_Order.exe (PID: 2928)
- pteropod.exe (PID: 3964)
- RegSvcs.exe (PID: 6200)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 4232)
Manual execution by a user
- RFQ_NO 00873609_VL103659-PR10465_Order.exe (PID: 2928)
- WinRAR.exe (PID: 4232)
Creates files or folders in the user directory
- RFQ_NO 00873609_VL103659-PR10465_Order.exe (PID: 2928)
- pteropod.exe (PID: 3964)
Reads the machine GUID from the registry
- RFQ_NO 00873609_VL103659-PR10465_Order.exe (PID: 2928)
- RegSvcs.exe (PID: 6200)
Reads the computer name
- RegSvcs.exe (PID: 6200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
XWorm
(PID) Process(6200) RegSvcs.exe
C2162.251.122.86:57903
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexfCXrE8L4kRTm48Ov
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 51 |
|---|---|
| ZipBitFlag: | 0x0009 |
| ZipCompression: | Unknown (99) |
| ZipModifyDate: | 2024:10:19 02:15:56 |
| ZipCRC: | 0x7edcab9b |
| ZipCompressedSize: | 474693 |
| ZipUncompressedSize: | 474636 |
| ZipFileName: | ___(1) - RFQ_NO 00873609_VL103659-PR10465_Order.zip |
Total processes
135
Monitored processes
6
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2928 | "C:\Users\admin\Desktop\YWX1\RFQ_NO 00873609_VL103659-PR10465_Order.exe" | C:\Users\admin\Desktop\YWX1\RFQ_NO 00873609_VL103659-PR10465_Order.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 3, 3, 6, 0 Modules
| |||||||||||||||
| 3964 | "C:\Users\admin\Desktop\YWX1\RFQ_NO 00873609_VL103659-PR10465_Order.exe" | C:\Users\admin\AppData\Local\arrogatingly\pteropod.exe | RFQ_NO 00873609_VL103659-PR10465_Order.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 3, 3, 6, 0 Modules
| |||||||||||||||
| 4232 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\YWX1\___(1) - RFQ_NO 00873609_VL103659-PR10465_Order.zip" C:\Users\admin\Desktop\YWX1\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 5444 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6200 | "C:\Users\admin\Desktop\YWX1\RFQ_NO 00873609_VL103659-PR10465_Order.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | pteropod.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Version: 4.8.9037.0 built by: NET481REL1 Modules
XWorm(PID) Process(6200) RegSvcs.exe C2162.251.122.86:57903 Keys AES<123456789> Options Splitter<Xwormmm> Sleep time3 USB drop nameXWorm V5.6 MutexfCXrE8L4kRTm48Ov | |||||||||||||||
| 6668 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\YWX1.zip | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
Total events
2 457
Read events
2 420
Write events
24
Delete events
13
Modification events
| (PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip | |||
| (PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\YWX1.zip | |||
| (PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | delete value | Name: | 15 |
Value: | |||
| (PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | delete value | Name: | 14 |
Value: | |||
| (PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | delete value | Name: | 13 |
Value: | |||
| (PID) Process: | (6668) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | delete value | Name: | 12 |
Value: | |||
Executable files
2
Suspicious files
3
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2928 | RFQ_NO 00873609_VL103659-PR10465_Order.exe | C:\Users\admin\AppData\Local\Temp\drawlingly | binary | |
MD5:E5273617C63B8D068AD1FD31111B1B15 | SHA256:1AA59205A83EEC1B12058BE28AF3D7D078FCCC5D028F80FCE4D0332F546B6CA1 | |||
| 6668 | WinRAR.exe | C:\Users\admin\Desktop\YWX1\___(1) - RFQ_NO 00873609_VL103659-PR10465_Order.zip | compressed | |
MD5:0E52AB76D35560D8C7DC305A1954B682 | SHA256:61B6C73C6B7377DDE8C6DCA6CF4DC95F19EBFC19C1D25505E1A5E0A648B06E6C | |||
| 4232 | WinRAR.exe | C:\Users\admin\Desktop\YWX1\RFQ_NO 00873609_VL103659-PR10465_Order.exe | executable | |
MD5:36881DE84E2D129A6A32E7A5C5537AEE | SHA256:9378BCF50D0A58428C5B2F7FD2284579927A48FD2E9D8F4F8395F932CB3DB1A6 | |||
| 2928 | RFQ_NO 00873609_VL103659-PR10465_Order.exe | C:\Users\admin\AppData\Local\arrogatingly\pteropod.exe | executable | |
MD5:36881DE84E2D129A6A32E7A5C5537AEE | SHA256:9378BCF50D0A58428C5B2F7FD2284579927A48FD2E9D8F4F8395F932CB3DB1A6 | |||
| 3964 | pteropod.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pteropod.vbs | binary | |
MD5:DA8E2C7DF6BA70E228C494FB9F5DD291 | SHA256:052AED377C54F55DC841771CED042AB1A5E5295EDC78AD4EBAEA54154D715E2C | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
23
DNS requests
13
Threats
174
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5488 | MoUsoCoreWorker.exe | GET | 200 | 23.73.2.140:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | SE | binary | 1.01 Kb | whitelisted |
4360 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | US | binary | 314 b | whitelisted |
4380 | SIHClient.exe | GET | 200 | 95.100.141.130:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | SE | binary | 419 b | whitelisted |
— | — | GET | 200 | 23.73.2.140:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | SE | binary | 1.01 Kb | whitelisted |
5488 | MoUsoCoreWorker.exe | GET | 200 | 95.100.141.130:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | SE | binary | 973 b | whitelisted |
4380 | SIHClient.exe | GET | 200 | 95.100.141.130:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | SE | binary | 408 b | whitelisted |
— | — | GET | 200 | 95.100.141.130:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | SE | binary | 973 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6944 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4360 | SearchApp.exe | 96.16.49.206:443 | www.bing.com | Akamai International B.V. | SE | whitelisted |
5488 | MoUsoCoreWorker.exe | 23.73.2.140:80 | crl.microsoft.com | Akamai International B.V. | SE | whitelisted |
— | — | 23.73.2.140:80 | crl.microsoft.com | Akamai International B.V. | SE | whitelisted |
4360 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
5488 | MoUsoCoreWorker.exe | 95.100.141.130:80 | www.microsoft.com | AKAMAI-AS | SE | whitelisted |
— | — | 95.100.141.130:80 | www.microsoft.com | AKAMAI-AS | SE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
6200 | RegSvcs.exe | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] Xworm TCP Packet |
173 ETPRO signatures available at the full report