xworm | c54430b097c3220bf89dceac9e0e4ecfa6ab95302b30830e0c4f0aa64d617267

General

Target

XClient.exe
Size

61KB
MD5

654a9a23f94cdcfe31cdd98cd7e9dd1f
SHA1

3e7fab38617cce17abc79b5c87fbdd9597940cda
SHA256

c54430b097c3220bf89dceac9e0e4ecfa6ab95302b30830e0c4f0aa64d617267
SHA512

e75b67e6b907c58a5f55a308618ba7311114da347c0d48ff8a7304986348115d917d654e65a81903ef82d005ee548e43e35b74b78c3de54fe7e17d32ac20a87c
SSDEEP

1536:cfBPd1ylaxTobN2bN4R1DL66Z/TpYOR/P3:cf1ylsYgbNwlVT+ORn3

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

WNIKO1-39869.portmap.host:39869

Attributes

install_file
USB.exe

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Local\\XClient.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2976	powershell.exe
1164	powershell.exe
668	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	XClient.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	2996	XClient.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2976	2996	XClient.exe	30
PID 2996 wrote to memory of 2976	2996	XClient.exe	30
PID 2996 wrote to memory of 2976	2996	XClient.exe	30
PID 2996 wrote to memory of 1164	2996	XClient.exe	32
PID 2996 wrote to memory of 1164	2996	XClient.exe	32
PID 2996 wrote to memory of 1164	2996	XClient.exe	32
PID 2996 wrote to memory of 668	2996	XClient.exe	34
PID 2996 wrote to memory of 668	2996	XClient.exe	34
PID 2996 wrote to memory of 668	2996	XClient.exe	34
PID 2996 wrote to memory of 2056	2996	XClient.exe	36
PID 2996 wrote to memory of 2056	2996	XClient.exe	36
PID 2996 wrote to memory of 2056	2996	XClient.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\XClient.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Local\XClient.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\XClient.exe

Filesize
61KB

MD5
654a9a23f94cdcfe31cdd98cd7e9dd1f

SHA1
3e7fab38617cce17abc79b5c87fbdd9597940cda

SHA256
c54430b097c3220bf89dceac9e0e4ecfa6ab95302b30830e0c4f0aa64d617267

SHA512
e75b67e6b907c58a5f55a308618ba7311114da347c0d48ff8a7304986348115d917d654e65a81903ef82d005ee548e43e35b74b78c3de54fe7e17d32ac20a87c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8a1518edbb14643fb3fc946f63218d90

SHA1
a756bc0ce170bc422b48ec9486a1355ab7e94c44

SHA256
e33ec02a555c6409d21e8e4dd5870ec0acf29b9d8d4541097f3865397344b119

SHA512
b87d8ec3aaae8931c2ce76d9aa073d7936484789db4a73ad7571f9b929b22e873be95a0f639cfc4774192d31d7f2ad0d0b7622629efeb60d861502dfee2cb0a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8a1518edbb14643fb3fc946f63218d90

SHA1
a756bc0ce170bc422b48ec9486a1355ab7e94c44

SHA256
e33ec02a555c6409d21e8e4dd5870ec0acf29b9d8d4541097f3865397344b119

SHA512
b87d8ec3aaae8931c2ce76d9aa073d7936484789db4a73ad7571f9b929b22e873be95a0f639cfc4774192d31d7f2ad0d0b7622629efeb60d861502dfee2cb0a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F7ZWM8ATCGBXZX3FRCRS.temp

Filesize
7KB

MD5
8a1518edbb14643fb3fc946f63218d90

SHA1
a756bc0ce170bc422b48ec9486a1355ab7e94c44

SHA256
e33ec02a555c6409d21e8e4dd5870ec0acf29b9d8d4541097f3865397344b119

SHA512
b87d8ec3aaae8931c2ce76d9aa073d7936484789db4a73ad7571f9b929b22e873be95a0f639cfc4774192d31d7f2ad0d0b7622629efeb60d861502dfee2cb0a6

Download Submit
memory/668-82-0x000000000285B000-0x0000000002892000-memory.dmp

Filesize
220KB

Download
memory/668-81-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/668-79-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/668-80-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/1164-69-0x000000001B1A0000-0x000000001B482000-memory.dmp

Filesize
2.9MB

Download
memory/1164-71-0x0000000002614000-0x0000000002617000-memory.dmp

Filesize
12KB

Download
memory/1164-72-0x000000000261B000-0x0000000002652000-memory.dmp

Filesize
220KB

Download
memory/1164-70-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2976-63-0x000000000294B000-0x0000000002982000-memory.dmp

Filesize
220KB

Download
memory/2976-62-0x0000000002944000-0x0000000002947000-memory.dmp

Filesize
12KB

Download
memory/2976-61-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/2976-60-0x000000001B340000-0x000000001B622000-memory.dmp

Filesize
2.9MB

Download
memory/2996-54-0x0000000000B20000-0x0000000000B36000-memory.dmp

Filesize
88KB

Download
memory/2996-55-0x000000001B160000-0x000000001B1E0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads