xworm | b027560460a95df9df7939576f6b3ad1e41282ceb4c0a9d563afbfb556d76d7d

General

Target

AppleCleanerNewVersion20e.exe
Size

76KB
MD5

f55955370be473cdb82d4b567ecf8d7d
SHA1

f209051a64c7c1663a3605e2b00cbbaea8523672
SHA256

b027560460a95df9df7939576f6b3ad1e41282ceb4c0a9d563afbfb556d76d7d
SHA512

c282749e749410ff6ba1a50c61a599fde4953e15820b9d0401e688b3a975f70eabc78c268f1b6c70248c82c8c0007e0a6be40e11c655f9108e49b426809d7f84
SSDEEP

1536:LBknikoXxQzdHrHpZu2Tk3bxk5DpoKj7016rnKYKkW9whtO3+fG2w3DYp8:LFIZDgbxsiKc6wwfO3+OXMp8

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

Attributes

install_file
USB.exe

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppleCleanerNewVersion20e.lnk	AppleCleanerNewVersion20e.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppleCleanerNewVersion20e.lnk	AppleCleanerNewVersion20e.exe

Executes dropped EXE 2 IoCs

pid	Process
1988	AppleCleanerNewVersion20e.exe
1552	AppleCleanerNewVersion20e.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
576	powershell.exe
1268	powershell.exe
396	powershell.exe
1392	AppleCleanerNewVersion20e.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	AppleCleanerNewVersion20e.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	1392	AppleCleanerNewVersion20e.exe
Token: SeDebugPrivilege	1988	AppleCleanerNewVersion20e.exe
Token: SeDebugPrivilege	1552	AppleCleanerNewVersion20e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1392	AppleCleanerNewVersion20e.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 576	1392	AppleCleanerNewVersion20e.exe	27
PID 1392 wrote to memory of 576	1392	AppleCleanerNewVersion20e.exe	27
PID 1392 wrote to memory of 576	1392	AppleCleanerNewVersion20e.exe	27
PID 1392 wrote to memory of 1268	1392	AppleCleanerNewVersion20e.exe	29
PID 1392 wrote to memory of 1268	1392	AppleCleanerNewVersion20e.exe	29
PID 1392 wrote to memory of 1268	1392	AppleCleanerNewVersion20e.exe	29
PID 1392 wrote to memory of 396	1392	AppleCleanerNewVersion20e.exe	31
PID 1392 wrote to memory of 396	1392	AppleCleanerNewVersion20e.exe	31
PID 1392 wrote to memory of 396	1392	AppleCleanerNewVersion20e.exe	31
PID 1392 wrote to memory of 1536	1392	AppleCleanerNewVersion20e.exe	33
PID 1392 wrote to memory of 1536	1392	AppleCleanerNewVersion20e.exe	33
PID 1392 wrote to memory of 1536	1392	AppleCleanerNewVersion20e.exe	33
PID 1828 wrote to memory of 1988	1828	taskeng.exe	36
PID 1828 wrote to memory of 1988	1828	taskeng.exe	36
PID 1828 wrote to memory of 1988	1828	taskeng.exe	36
PID 1828 wrote to memory of 1552	1828	taskeng.exe	37
PID 1828 wrote to memory of 1552	1828	taskeng.exe	37
PID 1828 wrote to memory of 1552	1828	taskeng.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AppleCleanerNewVersion20e.exe
"C:\Users\Admin\AppData\Local\Temp\AppleCleanerNewVersion20e.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\AppleCleanerNewVersion20e.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AppleCleanerNewVersion20e.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\AppleCleanerNewVersion20e.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AppleCleanerNewVersion20e" /tr "C:\Users\Admin\AppData\Roaming\AppleCleanerNewVersion20e.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1536

C:\Windows\system32\taskeng.exe
taskeng.exe {2FBF78F5-99DE-4689-A888-7B27FCC1CB04} S-1-5-21-3950455397-3229124517-1686476975-1000:NNDGNFRP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Roaming\AppleCleanerNewVersion20e.exe
  C:\Users\Admin\AppData\Roaming\AppleCleanerNewVersion20e.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Users\Admin\AppData\Roaming\AppleCleanerNewVersion20e.exe
  C:\Users\Admin\AppData\Roaming\AppleCleanerNewVersion20e.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AppleCleanerNewVersion20e.exe

Filesize
76KB

MD5
f55955370be473cdb82d4b567ecf8d7d

SHA1
f209051a64c7c1663a3605e2b00cbbaea8523672

SHA256
b027560460a95df9df7939576f6b3ad1e41282ceb4c0a9d563afbfb556d76d7d

SHA512
c282749e749410ff6ba1a50c61a599fde4953e15820b9d0401e688b3a975f70eabc78c268f1b6c70248c82c8c0007e0a6be40e11c655f9108e49b426809d7f84

Download Submit
C:\Users\Admin\AppData\Roaming\AppleCleanerNewVersion20e.exe

Filesize
76KB

MD5
f55955370be473cdb82d4b567ecf8d7d

SHA1
f209051a64c7c1663a3605e2b00cbbaea8523672

SHA256
b027560460a95df9df7939576f6b3ad1e41282ceb4c0a9d563afbfb556d76d7d

SHA512
c282749e749410ff6ba1a50c61a599fde4953e15820b9d0401e688b3a975f70eabc78c268f1b6c70248c82c8c0007e0a6be40e11c655f9108e49b426809d7f84

Download Submit
C:\Users\Admin\AppData\Roaming\AppleCleanerNewVersion20e.exe

Filesize
76KB

MD5
f55955370be473cdb82d4b567ecf8d7d

SHA1
f209051a64c7c1663a3605e2b00cbbaea8523672

SHA256
b027560460a95df9df7939576f6b3ad1e41282ceb4c0a9d563afbfb556d76d7d

SHA512
c282749e749410ff6ba1a50c61a599fde4953e15820b9d0401e688b3a975f70eabc78c268f1b6c70248c82c8c0007e0a6be40e11c655f9108e49b426809d7f84

Download Submit
C:\Users\Admin\AppData\Roaming\AppleCleanerNewVersion20e.exe

Filesize
76KB

MD5
f55955370be473cdb82d4b567ecf8d7d

SHA1
f209051a64c7c1663a3605e2b00cbbaea8523672

SHA256
b027560460a95df9df7939576f6b3ad1e41282ceb4c0a9d563afbfb556d76d7d

SHA512
c282749e749410ff6ba1a50c61a599fde4953e15820b9d0401e688b3a975f70eabc78c268f1b6c70248c82c8c0007e0a6be40e11c655f9108e49b426809d7f84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c7b3779b472acd0223c92b2014614d50

SHA1
dc4bbec0fe6c91b7c6c406932fd6f0dbc2cbf2c6

SHA256
81a38e89c7069a520bd5a815fa14eaa273bc2888d23a0d4aa9e5c51c6643c7cf

SHA512
e7f723ef0f9d60236e78ec7096dafa8ca5e21a63071e0b431e9d1224aea669307381f0ce6ae1bac7697cc610f2d439cf4d5d7314309828cac1e5f3fae8de9af9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c7b3779b472acd0223c92b2014614d50

SHA1
dc4bbec0fe6c91b7c6c406932fd6f0dbc2cbf2c6

SHA256
81a38e89c7069a520bd5a815fa14eaa273bc2888d23a0d4aa9e5c51c6643c7cf

SHA512
e7f723ef0f9d60236e78ec7096dafa8ca5e21a63071e0b431e9d1224aea669307381f0ce6ae1bac7697cc610f2d439cf4d5d7314309828cac1e5f3fae8de9af9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QFQQTVYQH56Q7G073RNZ.temp

Filesize
7KB

MD5
c7b3779b472acd0223c92b2014614d50

SHA1
dc4bbec0fe6c91b7c6c406932fd6f0dbc2cbf2c6

SHA256
81a38e89c7069a520bd5a815fa14eaa273bc2888d23a0d4aa9e5c51c6643c7cf

SHA512
e7f723ef0f9d60236e78ec7096dafa8ca5e21a63071e0b431e9d1224aea669307381f0ce6ae1bac7697cc610f2d439cf4d5d7314309828cac1e5f3fae8de9af9

Download Submit
memory/396-81-0x0000000002724000-0x0000000002727000-memory.dmp

Filesize
12KB

Download
memory/396-82-0x000000000272B000-0x0000000002762000-memory.dmp

Filesize
220KB

Download
memory/576-61-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/576-64-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/576-63-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/576-62-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/576-60-0x000000001B150000-0x000000001B432000-memory.dmp

Filesize
2.9MB

Download
memory/1268-73-0x0000000002330000-0x00000000023B0000-memory.dmp

Filesize
512KB

Download
memory/1268-74-0x0000000002330000-0x00000000023B0000-memory.dmp

Filesize
512KB

Download
memory/1268-72-0x0000000002330000-0x00000000023B0000-memory.dmp

Filesize
512KB

Download
memory/1268-71-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/1268-70-0x000000001B270000-0x000000001B552000-memory.dmp

Filesize
2.9MB

Download
memory/1392-54-0x00000000012E0000-0x00000000012FA000-memory.dmp

Filesize
104KB

Download
memory/1392-89-0x000000001AC80000-0x000000001AD00000-memory.dmp

Filesize
512KB

Download
memory/1392-55-0x000000001AC80000-0x000000001AD00000-memory.dmp

Filesize
512KB

Download
memory/1552-96-0x0000000000270000-0x000000000028A000-memory.dmp

Filesize
104KB

Download
memory/1988-94-0x0000000001320000-0x000000000133A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads