xworm | 479d3fbea1ab6818d3ddf15d99d97b156f201c0854a2105e6c67310da172ac52 | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
28-03-2023 03:17

Sharing

Report Analysis Logs

General

Target

svchost.exe
Size

44KB
MD5

e016d998cc83a07d7f527e2f2663c203
SHA1

ab620f5013ff3e035cd9adfbbd0fa39e6fe8e28c
SHA256

479d3fbea1ab6818d3ddf15d99d97b156f201c0854a2105e6c67310da172ac52
SHA512

914c3898c90b96812de904b923d27c6b70693b04ff6f09b74dcd7ddf846516927346c129b0b6503cb7867238c796f8ca4ec203e9bafb4ebba75019c769722047
SSDEEP

768:m3dZKcQ8A5MJqM+czV8+PR7hOP2qU3PQhLOSwo8/69j:EstkquzVfvO281O88/69j

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

license-donna.at.ply.gg:55049

Mutex

vPxQcY5x2JutoRz0

Attributes

install_file
USB.exe

aes.plain

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 2204 svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-121-0x00000000002F0000-0x0000000000302000-memory.dmp

Filesize
72KB

Download
memory/2204-124-0x000000001B700000-0x000000001B800000-memory.dmp

Filesize
1024KB

Download
memory/2204-125-0x000000001B700000-0x000000001B800000-memory.dmp

Filesize
1024KB

Download