xworm | 8caaeb5b77320ca29d578e3a241f5f7c999881119ef7ad39cf77bf19ebf27969

General

Target

Output.exe
Size

8.7MB
MD5

a847c5b2c607137258895d7eea6b4dcd
SHA1

3466265936587f66045712e9a1442ce0499648e0
SHA256

8caaeb5b77320ca29d578e3a241f5f7c999881119ef7ad39cf77bf19ebf27969
SHA512

1df2f03f2cd77f69b578860f7fd5447cfd9592cfaf9c38095c745cfb06ca82f867b42124f7cf16224a3ceb614d47852de07a23cf82dea96c1f1cbaf0f87f28ef
SSDEEP

196608:whO6foXVe5eGS2raPchWIXcXubIDd9sZijmUFrF8e:whOtXVeZgc5cXucE2meS

Score

10^/10

xworm persistence rat trojan

Malware Config

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 2 IoCs

Processes:

XClient.exeXClient.exe

pid	Process
1712	XClient.exe
1620	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exe

pid	Process
272	schtasks.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
1268	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

XClient.exe

pid	Process
1712	XClient.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

XClient.exeXClient.exe

description	pid	Process
Token: SeDebugPrivilege	1712	XClient.exe
Token: SeDebugPrivilege	1712	XClient.exe
Token: SeDebugPrivilege	1620	XClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XClient.exe

pid	Process
1712	XClient.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Output.exeXClient.exetaskeng.exe

description	pid	Process	procid_target
PID 1996 wrote to memory of 1712	1996	Output.exe	28
PID 1996 wrote to memory of 1712	1996	Output.exe	28
PID 1996 wrote to memory of 1712	1996	Output.exe	28
PID 1996 wrote to memory of 1268	1996	Output.exe	29
PID 1996 wrote to memory of 1268	1996	Output.exe	29
PID 1996 wrote to memory of 1268	1996	Output.exe	29
PID 1712 wrote to memory of 272	1712	XClient.exe	30
PID 1712 wrote to memory of 272	1712	XClient.exe	30
PID 1712 wrote to memory of 272	1712	XClient.exe	30
PID 548 wrote to memory of 1620	548	taskeng.exe	34
PID 548 wrote to memory of 1620	548	taskeng.exe	34
PID 548 wrote to memory of 1620	548	taskeng.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Output.exe
"C:\Users\Admin\AppData\Local\Temp\Output.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Creates scheduled task(s)
    PID:272
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\scriptdsss.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1268

C:\Windows\system32\taskeng.exe
taskeng.exe {D3513070-3161-481C-B608-06BACBE713A4} S-1-5-21-1283023626-844874658-3193756055-1000:THEQWNRW\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Roaming\XClient.exe
  C:\Users\Admin\AppData\Roaming\XClient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
65KB

MD5
da1b3270526547895c8d68d555e194ee

SHA1
d2463aa0024d55386e40a064b0b88266a5dd492b

SHA256
111b18ef362b9274c9290cc58ae2baa023def2fa04119e1432e290f091a4be04

SHA512
eb4c5b41871e2c33f345f26b9652710282d8a5c77e4fe53a409478eba7dbc1bb89e9fa9927c96c0351576d725f5af73e1469d7662f5686994f62c7dbfd383b6f

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
65KB

MD5
da1b3270526547895c8d68d555e194ee

SHA1
d2463aa0024d55386e40a064b0b88266a5dd492b

SHA256
111b18ef362b9274c9290cc58ae2baa023def2fa04119e1432e290f091a4be04

SHA512
eb4c5b41871e2c33f345f26b9652710282d8a5c77e4fe53a409478eba7dbc1bb89e9fa9927c96c0351576d725f5af73e1469d7662f5686994f62c7dbfd383b6f

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
65KB

MD5
da1b3270526547895c8d68d555e194ee

SHA1
d2463aa0024d55386e40a064b0b88266a5dd492b

SHA256
111b18ef362b9274c9290cc58ae2baa023def2fa04119e1432e290f091a4be04

SHA512
eb4c5b41871e2c33f345f26b9652710282d8a5c77e4fe53a409478eba7dbc1bb89e9fa9927c96c0351576d725f5af73e1469d7662f5686994f62c7dbfd383b6f

Download Submit
C:\Users\Admin\AppData\Roaming\scriptdsss.txt

Filesize
24KB

MD5
2febedd6fb832c4117e6b1cfa0de7188

SHA1
9038f640abd476416164421f4072a5b7e928c914

SHA256
77d8740e2935d53fa0107f80badf21c0330887154b91bd785362a746bbdb88c7

SHA512
ccc0cd3ddd1e5f0e6fb68bd2fa79e706d21ead9e62f2e31f46da7deb8cf1a08f02ce683b771610ca7e0599e02be76d4d70d69381bc8e6a567beafba1efedc7b5

Download Submit
memory/1712-61-0x00000000000E0000-0x00000000000F6000-memory.dmp

Filesize
88KB

Download
memory/1712-66-0x000000001B290000-0x000000001B310000-memory.dmp

Filesize
512KB

Download
memory/1712-67-0x000000001B290000-0x000000001B310000-memory.dmp

Filesize
512KB

Download
memory/1996-54-0x0000000000A80000-0x000000000133C000-memory.dmp

Filesize
8.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads