xworm | 415368c42994976a96d870c801364a58a56ace26be19dab123bb0c45f788c105

General

Target

SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
Size

53KB
MD5

64557121d459383777f4c4f5c611e59b
SHA1

c59a07cfb7f6268ed914137528fdfa857d20c1d8
SHA256

415368c42994976a96d870c801364a58a56ace26be19dab123bb0c45f788c105
SHA512

0409479575d93317b62518f028daeba2cabd7f0ccd91389da88c4c076b5adf18c1b9999e5f086393d82ca7c7a0789806d5079d549d2b5e2da0bee4e8484f5d62
SSDEEP

1536:5MZ6O2pAM4xs2P0IK5us4o9Fb2WPsM+Ofnxcx4v:Tj2PVK5us4o9FlPsM+OZ

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Mutex

jjcDBygdHXnsJ5oY

Attributes

install_file
USBDriver.exe
pastebin_url
https://pastebin.com/raw/fB4ZyQEn

aes.plain

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Executes dropped EXE 2 IoCs

Processes:

SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exeSecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe

pid process

1924 SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
1760 SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip-api.com
41 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1976 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

844 powershell.exe
1892 powershell.exe

pid	process
1924	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
1760	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe

flow	ioc
7	ip-api.com
41	ip-api.com

pid	process
1976	schtasks.exe

pid	process
844	powershell.exe
1892	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exepowershell.exepowershell.exeSecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exeSecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe

description	pid	process
Token: SeDebugPrivilege	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
Token: SeDebugPrivilege	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	1924	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
Token: SeDebugPrivilege	1760	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exetaskeng.exe

description	pid	process	target process
PID 1972 wrote to memory of 1976	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe	schtasks.exe
PID 1972 wrote to memory of 1976	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe	schtasks.exe
PID 1972 wrote to memory of 1976	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe	schtasks.exe
PID 1972 wrote to memory of 844	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe	powershell.exe
PID 1972 wrote to memory of 844	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe	powershell.exe
PID 1972 wrote to memory of 844	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe	powershell.exe
PID 1972 wrote to memory of 1892	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe	powershell.exe
PID 1972 wrote to memory of 1892	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe	powershell.exe
PID 1972 wrote to memory of 1892	1972	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe	powershell.exe
PID 1764 wrote to memory of 1924	1764	taskeng.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
PID 1764 wrote to memory of 1924	1764	taskeng.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
PID 1764 wrote to memory of 1924	1764	taskeng.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
PID 1764 wrote to memory of 1760	1764	taskeng.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
PID 1764 wrote to memory of 1760	1764	taskeng.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
PID 1764 wrote to memory of 1760	1764	taskeng.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460" /tr "C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1892

C:\Windows\system32\taskeng.exe
taskeng.exe {4EB67855-0F20-4A66-BB57-B90E8B6BC4B6} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
  C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
  C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0f9a52262798c165a19c5ee364b03c7a

SHA1
7476701d57bed92f75a1481e0127babb60805f25

SHA256
9c8730a7346a1f179355e42cc8f27c70b67260d57226471031cb23412bed9a7b

SHA512
52e41a3cacd9484ca4ba04aabcda3eb9626cec62844336e0999a7cb848da333a778ba454d15658e440067ce414f621fad7e4f8f6772958ac68f5eb866f69970c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\X0L2F667A5EWO6GDZ3OF.temp

Filesize
7KB

MD5
0f9a52262798c165a19c5ee364b03c7a

SHA1
7476701d57bed92f75a1481e0127babb60805f25

SHA256
9c8730a7346a1f179355e42cc8f27c70b67260d57226471031cb23412bed9a7b

SHA512
52e41a3cacd9484ca4ba04aabcda3eb9626cec62844336e0999a7cb848da333a778ba454d15658e440067ce414f621fad7e4f8f6772958ac68f5eb866f69970c

Download Submit
C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe

Filesize
53KB

MD5
64557121d459383777f4c4f5c611e59b

SHA1
c59a07cfb7f6268ed914137528fdfa857d20c1d8

SHA256
415368c42994976a96d870c801364a58a56ace26be19dab123bb0c45f788c105

SHA512
0409479575d93317b62518f028daeba2cabd7f0ccd91389da88c4c076b5adf18c1b9999e5f086393d82ca7c7a0789806d5079d549d2b5e2da0bee4e8484f5d62

Download Submit
C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe

Filesize
53KB

MD5
64557121d459383777f4c4f5c611e59b

SHA1
c59a07cfb7f6268ed914137528fdfa857d20c1d8

SHA256
415368c42994976a96d870c801364a58a56ace26be19dab123bb0c45f788c105

SHA512
0409479575d93317b62518f028daeba2cabd7f0ccd91389da88c4c076b5adf18c1b9999e5f086393d82ca7c7a0789806d5079d549d2b5e2da0bee4e8484f5d62

Download Submit
C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.IL.Trojan.MSILZilla.25629.12905.1460.exe

Filesize
53KB

MD5
64557121d459383777f4c4f5c611e59b

SHA1
c59a07cfb7f6268ed914137528fdfa857d20c1d8

SHA256
415368c42994976a96d870c801364a58a56ace26be19dab123bb0c45f788c105

SHA512
0409479575d93317b62518f028daeba2cabd7f0ccd91389da88c4c076b5adf18c1b9999e5f086393d82ca7c7a0789806d5079d549d2b5e2da0bee4e8484f5d62

Download Submit
memory/844-63-0x00000000027C4000-0x00000000027C7000-memory.dmp

Filesize
12KB

Download
memory/844-64-0x00000000027CB000-0x0000000002802000-memory.dmp

Filesize
220KB

Download
memory/844-61-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download
memory/844-60-0x000000001B3B0000-0x000000001B692000-memory.dmp

Filesize
2.9MB

Download
memory/1760-80-0x00000000002E0000-0x00000000002F4000-memory.dmp

Filesize
80KB

Download
memory/1892-70-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

Filesize
2.9MB

Download
memory/1892-71-0x0000000002510000-0x0000000002518000-memory.dmp

Filesize
32KB

Download
memory/1892-72-0x00000000026B4000-0x00000000026B7000-memory.dmp

Filesize
12KB

Download
memory/1892-73-0x00000000026BB000-0x00000000026F2000-memory.dmp

Filesize
220KB

Download
memory/1924-78-0x0000000001050000-0x0000000001064000-memory.dmp

Filesize
80KB

Download
memory/1972-62-0x000000001AFE0000-0x000000001B060000-memory.dmp

Filesize
512KB

Download
memory/1972-74-0x000000001AFE0000-0x000000001B060000-memory.dmp

Filesize
512KB

Download
memory/1972-54-0x0000000001030000-0x0000000001044000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads