File name: | 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe |
Full analysis: | https://app.any.run/tasks/957503e9-9f37-46b8-840d-09ee8e8e9f89 |
Verdict: | Malicious activity |
Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
Analysis date: | April 07, 2024, 07:33:31 |
OS: | Windows 10 Professional (build: 19044, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
MD5: | F267A71692C3683E3D6D0461E003F54F |
SHA1: | 189450A513D1F2412470EB965468F1324633D252 |
SHA256: | 74531F459FDB6837669583DC731B7A6AFAD5378782AB8BCA5D726EDAC753F251 |
SSDEEP: | 98304:bIgTMuB0kbmErby6Zbu2icuY8AvunEgMJJSLNrrjr/yDdpszicNpJgz0dVLvp7aA:8XX |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
AssemblyVersion: | 10.0.17763.1075 |
---|---|
ProductVersion: | 10.0.17763.1075 |
ProductName: | Microsoft® Windows® Operating System |
OriginalFileName: | Mayfro.exe |
LegalTrademarks: | - |
LegalCopyright: | © Microsoft Corporation. All rights reserved. |
InternalName: | Mayfro.exe |
FileVersion: | 10.0.17763.1075 |
FileDescription: | Runtime Broker |
CompanyName: | Microsoft Corporation |
Comments: | Runtime Broker |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 10.0.17763.1075 |
FileVersionNumber: | 10.0.17763.1075 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x2582e6 |
UninitializedDataSize: | - |
InitializedDataSize: | 2560 |
CodeSize: | 2450432 |
LinkerVersion: | 6 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
TimeStamp: | 2024:04:07 05:52:49+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3196 | "C:\Users\admin\AppData\Local\Temp\74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe" | C:\Users\admin\AppData\Local\Temp\74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Runtime Broker Exit code: 0 Version: 10.0.17763.1075 Modules
| |||||||||||||||
7072 | "C:\WINDOWS\SysWOW64\cmd.exe" /k START "" "C:\Users\admin\AppData\Local\Temp\74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe" & EXIT | C:\Windows\SysWOW64\cmd.exe | 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.746 (WinBuild.160101.0800) Modules
| |||||||||||||||
1640 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
6896 | "C:\Users\admin\AppData\Local\Temp\74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe" | C:\Users\admin\AppData\Local\Temp\74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Runtime Broker Exit code: 0 Version: 10.0.17763.1075 Modules
| |||||||||||||||
6104 | "C:\Users\admin\AppData\Local\Temp\$77c86b15" | C:\Users\admin\AppData\Local\Temp\$77c86b15 | 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Runtime Broker Exit code: 3221225477 Version: 10.0.17763.1075 Modules
| |||||||||||||||
7028 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6104 -s 408 | C:\Windows\SysWOW64\WerFault.exe | $77c86b15 | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.1081 (WinBuild.160101.0800) Modules
| |||||||||||||||
7068 | "C:\Users\admin\AppData\Local\Temp\$77627d34" | C:\Users\admin\AppData\Local\Temp\$77627d34 | 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Runtime Broker Version: 10.0.17763.1075 Modules
XWorm(PID) Process(7068) $77627d34 C2gamemodz.duckdns.org:6969 Keys AES<123456789> Options Splitter<Xwormmm> Sleep time3 USB drop nameUSB.exe Mutex7nYjxhsucshBdVBK | |||||||||||||||
2712 | "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77627d34" /tr "C:\Users\admin\AppData\Roaming\$77627d34" | C:\Windows\SysWOW64\schtasks.exe | — | $77627d34 | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
4084 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
5128 | C:\Users\admin\AppData\Roaming\$77627d34 | C:\Users\admin\AppData\Roaming\$77627d34 | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Runtime Broker Exit code: 0 Version: 10.0.17763.1075 Modules
|
(PID) Process: | (3196) 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3196) 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3196) 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3196) 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (6896) 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Google |
Operation: | write | Name: | 001 |
Value: 32 | |||
(PID) Process: | (7028) WerFault.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags |
Operation: | delete value | Name: | AmiOverridePath |
Value: C:\WINDOWS\AppCompat\Programs\Amcache.hve.tmp | |||
(PID) Process: | (7028) WerFault.exe | Key: | \REGISTRY\A\{570dcd8c-da4e-4b44-c65b-dcda209b3aec}\Root\InventoryApplicationFile |
Operation: | write | Name: | WritePermissionsCheck |
Value: 1 | |||
(PID) Process: | (7028) WerFault.exe | Key: | \REGISTRY\A\{570dcd8c-da4e-4b44-c65b-dcda209b3aec}\Root\InventoryApplicationFile\PermissionsCheckTestKey |
Operation: | delete key | Name: | (default) |
Value: | |||
(PID) Process: | (7028) WerFault.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData |
Operation: | write | Name: | ClockTimeSeconds |
Value: 554C126600000000 | |||
(PID) Process: | (7028) WerFault.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData |
Operation: | write | Name: | TickCount |
Value: 6BFD0D0000000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3196 | 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | C:\Users\admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe.log | text | |
MD5:— | SHA256:— | |||
6896 | 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | C:\Users\admin\AppData\Local\Temp\$77c86b15 | executable | |
MD5:— | SHA256:— | |||
7028 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC42.tmp.dmp | binary | |
MD5:— | SHA256:— | |||
7028 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC92.tmp.WERInternalMetadata.xml | xml | |
MD5:— | SHA256:— | |||
7028 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERFCB2.tmp.xml | xml | |
MD5:— | SHA256:— | |||
7028 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_$77c86b15_438468b6a5e58b1b82db3933706355d363de288_ce7108d4_d2321f78-043d-4210-84ed-c2b260c31029\Report.wer | — | |
MD5:— | SHA256:— | |||
7028 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\$77c86b15.6104.dmp | binary | |
MD5:— | SHA256:— | |||
6896 | 74531f459fdb6837669583dc731b7a6afad5378782ab8bca5d726edac753f251.exe | C:\Users\admin\AppData\Local\Temp\$77627d34 | executable | |
MD5:— | SHA256:— | |||
7068 | $77627d34 | C:\Users\admin\AppData\Roaming\$77627d34 | executable | |
MD5:— | SHA256:— | |||
7068 | $77627d34 | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77627d34.lnk | binary | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
7068 | $77627d34 | GET | 200 | 208.95.112.1:80 | http://ip-api.com/line/?fields=hosting | unknown | — | — | unknown |
5272 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D | unknown | — | — | unknown |
4800 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | unknown |
3996 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
6576 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | unknown |
6576 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4828 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
1280 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6140 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3996 | svchost.exe | 40.126.31.69:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3996 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
7028 | WerFault.exe | 52.168.117.173:443 | umwatson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
3996 | svchost.exe | 20.190.159.75:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7068 | $77627d34 | 208.95.112.1:80 | ip-api.com | TUT-AS | US | unknown |
3996 | svchost.exe | 20.190.159.73:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4800 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
Domain | IP | Reputation |
---|---|---|
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
umwatson.events.data.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
ip-api.com |
| shared |
arc.msn.com |
| whitelisted |
gamemodz.duckdns.org |
| malicious |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
7068 | $77627d34 | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ip-api. com) |
7068 | $77627d34 | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External Hosting Lookup by ip-api |
7068 | $77627d34 | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
7068 | $77627d34 | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] Xworm TCP Initial Packet |