Windows Analysis Report
Xworm v5.6 cracked.exe

Overview

General Information

Sample name: Xworm v5.6 cracked.exe
Analysis ID: 1639461
MD5: 863548a6d93b80e144b84e3251b6508c
SHA1: 5bb751242aa40d322eb4748170915bcaa8859d6c
SHA256: 9383750da9a2ff90ac05ef9e09703a12849ca810912d60e3b946df859613822c
Tags: exeuser-BastianHein
Infos:

Detection

XWorm
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates files with lurking names (e.g. Crack.exe)
Joe Sandbox ML detected suspicious sample
Sample uses string decryption to hide its real strings
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Creates a start menu entry (Start Menu\Programs\Startup)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Xworm v5.6 cracked.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Avira: detection malicious, Label: TR/Spy.Gen
Found malware configuration
Source: Xworm v5.6 cracked.exe Malware Configuration Extractor: Xworm {"C2 url": ["127.0.0.1"], "Port": 1234, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\XClient.exe ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\XClient.exe Virustotal: Detection: 68% Perma Link
Multi AV Scanner detection for submitted file
Source: Xworm v5.6 cracked.exe Virustotal: Detection: 68% Perma Link
Source: Xworm v5.6 cracked.exe ReversingLabs: Detection: 83%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Sample uses string decryption to hide its real strings
Source: Xworm v5.6 cracked.exe String decryptor: 127.0.0.1
Source: Xworm v5.6 cracked.exe String decryptor: 1234
Source: Xworm v5.6 cracked.exe String decryptor: <123456789>
Source: Xworm v5.6 cracked.exe String decryptor: <Xwormmm>
Source: Xworm v5.6 cracked.exe String decryptor: XWorm V5.6
Source: Xworm v5.6 cracked.exe String decryptor: USB.exe
Source: Xworm v5.6 cracked.exe String decryptor: %Temp%
Source: Xworm v5.6 cracked.exe String decryptor: XClient.exe
Uses 32bit PE files
Source: Xworm v5.6 cracked.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Xworm v5.6 cracked.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: Microsoft.VisualBasic.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Xml.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: indoC:\Windows\mssorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2632658885.000000001B668000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Xml.pdb) source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbf source: Xworm v5.6 cracked.exe, 00000000.00000002.2630331387.0000000000694000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.pdbMZ@ source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Microsoft.VisualBasic.pdbpy source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.ni.pdbRSDS source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Windows.Forms.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Drawing.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb=#P source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Configuration.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Drawing.ni.pdbRSDS source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Xml.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: 0C:\Windows\mscorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2632658885.000000001B668000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Xml.ni.pdbRSDS# source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Core.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: ]symbols\dll\mscorlib.pdbpdb` source: Xworm v5.6 cracked.exe, 00000000.00000002.2632658885.000000001B668000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2630331387.0000000000694000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb@#K source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp, Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B370000.00000004.00000020.00020000.00000000.sdmp, WERC2AA.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2630331387.0000000000694000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.ni.pdbRSDS source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Drawing.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: orlib.pdbpdblib.pdbC_64\m source: Xworm v5.6 cracked.exe, 00000000.00000002.2632658885.000000001B668000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Core.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdbc!u source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdbs!e source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: mscorlib.pdbH source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERC2AA.tmp.dmp.15.dr

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 127.0.0.1
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.5:53950 -> 1.1.1.1:53
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: Amcache.hve.15.dr String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: Xworm v5.6 cracked.exe, XLogger.cs .Net Code: KeyboardLayout
Source: XClient.exe.0.dr, XLogger.cs .Net Code: KeyboardLayout

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Xworm v5.6 cracked.exe, type: SAMPLE Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: Xworm v5.6 cracked.exe, type: SAMPLE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.Xworm v5.6 cracked.exe.130000.0.unpack, type: UNPACKEDPE Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.Xworm v5.6 cracked.exe.130000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1264746954.0000000000132000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED Matched rule: Detects AsyncRAT Author: ditekSHen
Creates files with lurking names (e.g. Crack.exe)
Source: C:\Windows\System32\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Xworm v5.6 crack_c6eb94441312a9254c1195d937f1fd9982f365d_83b00e51_0c7547cb-ef4d-42e3-b1a0-9e28ab6132c5 Jump to behavior
Source: C:\Windows\System32\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Xworm v5.6 crack_c6eb94441312a9254c1195d937f1fd9982f365d_83b00e51_0c7547cb-ef4d-42e3-b1a0-9e28ab6132c5\16a5c46a-8aae-46cc-94d7-93bafa63229f Jump to behavior
Source: C:\Windows\System32\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Xworm v5.6 crack_c6eb94441312a9254c1195d937f1fd9982f365d_83b00e51_0c7547cb-ef4d-42e3-b1a0-9e28ab6132c5\Report.wer Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Code function: 0_2_00007FF7C8170C2E 0_2_00007FF7C8170C2E
One or more processes crash
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 8060 -s 1480
Uses 32bit PE files
Source: Xworm v5.6 cracked.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: Xworm v5.6 cracked.exe, type: SAMPLE Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: Xworm v5.6 cracked.exe, type: SAMPLE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.Xworm v5.6 cracked.exe.130000.0.unpack, type: UNPACKEDPE Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.Xworm v5.6 cracked.exe.130000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1264746954.0000000000132000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Xworm v5.6 cracked.exe, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Xworm v5.6 cracked.exe, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Xworm v5.6 cracked.exe, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XClient.exe.0.dr, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Xworm v5.6 cracked.exe, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Xworm v5.6 cracked.exe, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@2/8@0/1
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8060
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Mutant created: \Sessions\1\BaseNamedObjects\plE9V2u85WHScOR6
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe File created: C:\Users\user\AppData\Local\Temp\XClient.exe Jump to behavior
Source: Xworm v5.6 cracked.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Xworm v5.6 cracked.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Xworm v5.6 cracked.exe Virustotal: Detection: 68%
Source: Xworm v5.6 cracked.exe ReversingLabs: Detection: 83%
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe File read: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Xworm v5.6 cracked.exe "C:\Users\user\Desktop\Xworm v5.6 cracked.exe"
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 8060 -s 1480
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32 Jump to behavior
Source: XClient.lnk.0.dr LNK file: ..\..\..\..\..\..\Local\Temp\XClient.exe
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: Xworm v5.6 cracked.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Xworm v5.6 cracked.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: Microsoft.VisualBasic.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Xml.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: indoC:\Windows\mssorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2632658885.000000001B668000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Xml.pdb) source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbf source: Xworm v5.6 cracked.exe, 00000000.00000002.2630331387.0000000000694000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.pdbMZ@ source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Microsoft.VisualBasic.pdbpy source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.ni.pdbRSDS source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Windows.Forms.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Drawing.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb=#P source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Configuration.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Drawing.ni.pdbRSDS source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Xml.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: 0C:\Windows\mscorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2632658885.000000001B668000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Xml.ni.pdbRSDS# source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Core.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: ]symbols\dll\mscorlib.pdbpdb` source: Xworm v5.6 cracked.exe, 00000000.00000002.2632658885.000000001B668000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2630331387.0000000000694000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdb@#K source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp, Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B370000.00000004.00000020.00020000.00000000.sdmp, WERC2AA.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: Xworm v5.6 cracked.exe, 00000000.00000002.2630331387.0000000000694000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Windows.Forms.ni.pdbRSDS source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Drawing.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: orlib.pdbpdblib.pdbC_64\m source: Xworm v5.6 cracked.exe, 00000000.00000002.2632658885.000000001B668000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Core.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdbc!u source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdbs!e source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.ni.pdb source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: mscorlib.pdbH source: WERC2AA.tmp.dmp.15.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERC2AA.tmp.dmp.15.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: Xworm v5.6 cracked.exe, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Xworm v5.6 cracked.exe, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Xworm v5.6 cracked.exe, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.0.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.0.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.0.dr, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: Xworm v5.6 cracked.exe, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: Xworm v5.6 cracked.exe, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: Xworm v5.6 cracked.exe, Messages.cs .Net Code: Memory
Source: XClient.exe.0.dr, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, Messages.cs .Net Code: Memory
Drops PE files
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe File created: C:\Users\user\AppData\Local\Temp\XClient.exe Jump to dropped file
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Memory allocated: 2220000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Memory allocated: 1A3F0000 memory reserve | memory write watch Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Window / User API: threadDelayed 9701 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe TID: 3308 Thread sleep count: 249 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe TID: 3308 Thread sleep time: -249000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe TID: 3308 Thread sleep count: 9701 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe TID: 3308 Thread sleep time: -9701000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: Amcache.hve.15.dr Binary or memory string: VMware
Source: Amcache.hve.15.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.15.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.15.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.15.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.15.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.15.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.15.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.15.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.15.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.15.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.15.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Xworm v5.6 cracked.exe, 00000000.00000002.2632437050.000000001B3AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.15.dr Binary or memory string: VMware Virtual RAMX
Source: Amcache.hve.15.dr Binary or memory string: vmci.sys
Source: Amcache.hve.15.dr Binary or memory string: VMware-42 27 d9 2e dc 89 72 dd-92 e8 86 9f a5 a6 64 93
Source: Amcache.hve.15.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.15.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.15.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.15.dr Binary or memory string: VMware20,1
Source: Amcache.hve.15.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.15.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.15.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.15.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.15.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.15.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.15.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.15.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.15.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.24224532.B64.2408191502,BiosReleaseDate:08/19/2024,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.15.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process queried: DebugPort Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Queries volume information: C:\Users\user\Desktop\Xworm v5.6 cracked.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Xworm v5.6 cracked.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.15.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.15.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.15.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.15.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected XWorm
Source: Yara match File source: Xworm v5.6 cracked.exe, type: SAMPLE
Source: Yara match File source: 0.0.Xworm v5.6 cracked.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1264746954.0000000000132000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Xworm v5.6 cracked.exe PID: 8060, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected XWorm
Source: Yara match File source: Xworm v5.6 cracked.exe, type: SAMPLE
Source: Yara match File source: 0.0.Xworm v5.6 cracked.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1264746954.0000000000132000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Xworm v5.6 cracked.exe PID: 8060, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\XClient.exe, type: DROPPED
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1639461 Sample: Xworm v5.6 cracked.exe Startdate: 15/03/2025 Architecture: WINDOWS Score: 100 20 Found malware configuration 2->20 22 Malicious sample detected (through community Yara rule) 2->22 24 Antivirus detection for dropped file 2->24 26 10 other signatures 2->26 6 Xworm v5.6 cracked.exe 6 2->6         started        process3 dnsIp4 18 127.0.0.1 unknown unknown 6->18 14 C:\Users\user\AppData\Local\...\XClient.exe, PE32 6->14 dropped 10 WerFault.exe 22 16 6->10         started        file5 process6 file7 16 C:\ProgramData\Microsoft\...\Report.wer, Unicode 10->16 dropped 28 Creates files with lurking names (e.g. Crack.exe) 10->28 signatures8

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private

IP
127.0.0.1

Contacted URLs

Name Malicious Antivirus Detection Reputation
127.0.0.1 false
    		high