xworm | 2eb02ce78ef2d03967bd2bd9bfca795a49c769120a65515234318bafe2106e50

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

XClient_3.exe
Size

36KB
MD5

a4b63c56b018a0df0864ac93518e23f2
SHA1

aac28ab89ed8e522b3c98edd086e264a844cb1f3
SHA256

2eb02ce78ef2d03967bd2bd9bfca795a49c769120a65515234318bafe2106e50
SHA512

045e25c30bf9fd25c04bef21cd08374f8c5a6101bbe0988998e0d368aa90e4af14b5579a5219f9eeedc72303d55150fce86cd13b394ebb28d1faadfd768e21d3
SSDEEP

768:iJTGHc+WWls9fMO20ImlVFp/X/FP79lDO9hDApi:i5Yc40bI6TnFz9lDO9R

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

16.ip.gl.ply.gg:15179

Mutex

wPJHugnoj2JkmLtM

Attributes

install_file
svchost.exe

aes.plain

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient_3.lnk	XClient_3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient_3.lnk	XClient_3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	XClient_3.exe
Token: SeDebugPrivilege	3428	XClient_3.exe

C:\Users\Admin\AppData\Local\Temp\XClient_3.exe
"C:\Users\Admin\AppData\Local\Temp\XClient_3.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3428-0-0x0000000000E10000-0x0000000000E20000-memory.dmp

Filesize
64KB

Download
memory/3428-1-0x00007FFB003B0000-0x00007FFB00E71000-memory.dmp

Filesize
10.8MB

Download
memory/3428-6-0x000000001BC70000-0x000000001BC80000-memory.dmp

Filesize
64KB

Download
memory/3428-7-0x00007FFB003B0000-0x00007FFB00E71000-memory.dmp

Filesize
10.8MB

Download
memory/3428-8-0x000000001BC70000-0x000000001BC80000-memory.dmp

Filesize
64KB

Download