xworm | 4060e66fbf7ff0ba0514d76d7e89e7e79f75b381d8145eb1fad15da55a2a9393

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2023 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0x000100000002311c-140.exe
Size

156KB
MD5

ed44dc5ec5d2f4f29288cc873d7b6e5e
SHA1

63f471a8a2f5d21c6cc717ff4df5963fe0b426be
SHA256

4060e66fbf7ff0ba0514d76d7e89e7e79f75b381d8145eb1fad15da55a2a9393
SHA512

5aa192bfa71a94915e50ecdb40d59452b9c44bafd019b4d0632455a53034df6a28dd1bef663b0ad20889a60f65165d3ea317d1be3230c0d36d59377126a9d2a3
SSDEEP

3072:zN+vmIkjrj5dks6rZbFdUOB1dHBz65/M6If+3Js+3JFkKeTno:zN+uIorjTk9NbfHxBt25

Score

10^/10

xworm persistence rat trojan

Malware Config

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0x000100000002311c-140.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	0x000100000002311c-140.exe

Drops startup file 2 IoCs

Processes:

0x000100000002311c-140.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0x000100000002311c-140.lnk	0x000100000002311c-140.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0x000100000002311c-140.lnk	0x000100000002311c-140.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0x000100000002311c-140.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0x000100000002311c-140 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0x000100000002311c-140.exe"	0x000100000002311c-140.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1516 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0x000100000002311c-140.exe

pid process

4216 0x000100000002311c-140.exe

pid	process
1516	schtasks.exe

pid	process
4216	0x000100000002311c-140.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

0x000100000002311c-140.exe0x000100000002311c-140.exe0x000100000002311c-140.exe

description	pid	process
Token: SeDebugPrivilege	4216	0x000100000002311c-140.exe
Token: SeDebugPrivilege	4216	0x000100000002311c-140.exe
Token: SeDebugPrivilege	2728	0x000100000002311c-140.exe
Token: SeDebugPrivilege	4736	0x000100000002311c-140.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0x000100000002311c-140.exe

pid process

4216 0x000100000002311c-140.exe

pid	process
4216	0x000100000002311c-140.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

0x000100000002311c-140.exe

description	pid	process	target process
PID 4216 wrote to memory of 1516	4216	0x000100000002311c-140.exe	schtasks.exe
PID 4216 wrote to memory of 1516	4216	0x000100000002311c-140.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0x000100000002311c-140.exe
"C:\Users\Admin\AppData\Local\Temp\0x000100000002311c-140.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "0x000100000002311c-140" /tr "C:\Users\Admin\AppData\Local\Temp\0x000100000002311c-140.exe"
2⤵
- Creates scheduled task(s)
PID:1516

C:\Users\Admin\AppData\Local\Temp\0x000100000002311c-140.exe
C:\Users\Admin\AppData\Local\Temp\0x000100000002311c-140.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Users\Admin\AppData\Local\Temp\0x000100000002311c-140.exe
C:\Users\Admin\AppData\Local\Temp\0x000100000002311c-140.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\0x000100000002311c-140.exe.log
Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
memory/4216-133-0x00000000001B0000-0x00000000001DC000-memory.dmp

Filesize
176KB

Download
memory/4216-135-0x000000001BA20000-0x000000001BA30000-memory.dmp

Filesize
64KB

Download
memory/4216-136-0x000000001BA20000-0x000000001BA30000-memory.dmp

Filesize
64KB

Download