Overview

overview

10

Static

static

10

XWormLoader.exe

windows10-2004-x64

10

Resubmissions

08-10-2023 02:15

231008-cpn34abg92 10

Analysis

  • max time kernel
    162s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-10-2023 02:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XWormLoader.exe

  • Size

    114KB

  • MD5

    445416feb4af892c3eec6ded8f096640

  • SHA1

    55b1e3ded6047f356f768897b4311f4a0c2d5fc5

  • SHA256

    a3117471e5def03a3e40743111d5f2382a04331356e256b02a4a07ecd3575a12

  • SHA512

    b8aacc765c46711df5b9d42fd314fff1146f8f5e24628ffdda9a23e309dd925ea848862b2dd05220f7cf3763166846d8c469316a0502a11da01018228858ce4b

  • SSDEEP

    1536:gVzoQD1KmzGkzf2as/bBcGjLzy6p69nL5yCOmZhiybUojgTmbIr7D6DULNtt7mw:2fD88aas/bBNfYUCOmDtbzar7EEd7x

Score
10/10
xwormpersistencerattrojan

Malware Config

Signatures

  • Detect Xworm Payload 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 58 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3288
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWormLoader.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormLoader.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:320
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Update'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Update'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2944
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Update" /tr "C:\Users\Admin\AppData\Roaming\Update"
      2⤵
      • Creates scheduled task(s)
      PID:4560
  • C:\Windows\system32\werfault.exe
    werfault.exe /h /shared Global\779672b5026344e2ad5477ff7bacef36 /t 3300 /p 3136
    1⤵
      PID:940
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4896
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3016
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5012
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2588
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3764
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2564
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1272
    • C:\Users\Admin\AppData\Roaming\Update
      C:\Users\Admin\AppData\Roaming\Update
      1⤵
      • Executes dropped EXE
      PID:1824

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
      Filesize

      471B

      MD5

      4c89a3253444e3534a8d0804a57ab526

      SHA1

      0b8a68a6f934e1a17b1a78cff5d4d9bb392d22c4

      SHA256

      75254e24703b9eec69f23c9153879875491b3ad72d295d535eacce17025b5ebd

      SHA512

      49f10d7a21100c70b80c4cac6bb8b2ee2af646b5dd385bdc34e564ebee2c2ab49d21575968ecdeed6154682ceba7a02b3c732c7143f741ba8e890ca9dd1ec1c1

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
      Filesize

      412B

      MD5

      c97a5f1188006643e2d8b4786610de9d

      SHA1

      50cc4c9f287fe55054d2ba979a8439fa4ddbb21c

      SHA256

      be8757ecd6eabbeee3a25613fd8625e3307ff4327d4dacfe04f134940c3d486c

      SHA512

      ac4a796e2d8b877e2cd200e9db41a794f2bef219d42dfa7226cd014c34fd97863ec2af23900f75485e3866b8d66416676c9309c6660b3307f6f6adffdf86e5da

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      6d3e9c29fe44e90aae6ed30ccf799ca8

      SHA1

      c7974ef72264bbdf13a2793ccf1aed11bc565dce

      SHA256

      2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

      SHA512

      60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      110b59ca4d00786d0bde151d21865049

      SHA1

      557e730d93fdf944a0cad874022df1895fb5b2e2

      SHA256

      77f69011c214ea5a01fd2035d781914c4893aee66d784deadc22179eadfdf77f

      SHA512

      cb55ac6eca50f4427718bace861679c88b2fdfea94d30209e8d61ca73a6ce9f8c4b5334922d2660a829b0636d20cbdf3bae1497c920e604efe6c636019feb10e

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      65a68df1062af34622552c4f644a5708

      SHA1

      6f6ecf7b4b635abb0b132d95dac2759dc14b50af

      SHA256

      718dc2f5f4a6dbb7fab7f3db05bd7f602fb16526caae7084ab46c3ab4e7bad35

      SHA512

      4e460eb566032942547b58411222dd26ae300a95f83cf5ae6df58ebd28594341123611b348bd4031a33bc7f38307d5cb8fb677bba8c896919e3eee677a104d4d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n1sl1y1w.02j.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Update
      Filesize

      114KB

      MD5

      445416feb4af892c3eec6ded8f096640

      SHA1

      55b1e3ded6047f356f768897b4311f4a0c2d5fc5

      SHA256

      a3117471e5def03a3e40743111d5f2382a04331356e256b02a4a07ecd3575a12

      SHA512

      b8aacc765c46711df5b9d42fd314fff1146f8f5e24628ffdda9a23e309dd925ea848862b2dd05220f7cf3763166846d8c469316a0502a11da01018228858ce4b

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Update
      Filesize

      114KB

      MD5

      445416feb4af892c3eec6ded8f096640

      SHA1

      55b1e3ded6047f356f768897b4311f4a0c2d5fc5

      SHA256

      a3117471e5def03a3e40743111d5f2382a04331356e256b02a4a07ecd3575a12

      SHA512

      b8aacc765c46711df5b9d42fd314fff1146f8f5e24628ffdda9a23e309dd925ea848862b2dd05220f7cf3763166846d8c469316a0502a11da01018228858ce4b

      Download Submit

    • memory/320-28-0x00007FFCD34E0000-0x00007FFCD3FA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/320-40-0x0000023283FB0000-0x0000023283FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/320-43-0x00007FFCD34E0000-0x00007FFCD3FA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/320-41-0x0000023283FB0000-0x0000023283FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/320-29-0x0000023283FB0000-0x0000023283FC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1272-93-0x000002A2B9ED0000-0x000002A2B9EF0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1272-90-0x000002A2B9F10000-0x000002A2B9F30000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1272-95-0x000002A2BA2E0000-0x000002A2BA300000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2944-62-0x000001D30B2D0000-0x000001D30B2E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2944-78-0x00007FFCD34E0000-0x00007FFCD3FA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2944-73-0x000001D30B2D0000-0x000001D30B2E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2944-60-0x00007FFCD34E0000-0x00007FFCD3FA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2944-61-0x000001D30B2D0000-0x000001D30B2E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3288-0-0x0000000000660000-0x0000000000682000-memory.dmp

      Filesize

      136KB

      Download

    • memory/3288-4-0x00000000028A0000-0x00000000028B0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3288-3-0x00000000028A0000-0x00000000028B0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3288-2-0x00007FFCD34E0000-0x00007FFCD3FA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3288-1-0x00007FFCD34E0000-0x00007FFCD3FA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3764-83-0x0000000004410000-0x0000000004411000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4292-44-0x00007FFCD34E0000-0x00007FFCD3FA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4292-59-0x00007FFCD34E0000-0x00007FFCD3FA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4292-57-0x0000019697420000-0x0000019697430000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4292-56-0x0000019697420000-0x0000019697430000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4292-55-0x0000019697420000-0x0000019697430000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4928-26-0x00007FFCD34E0000-0x00007FFCD3FA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4928-19-0x0000013EDAE30000-0x0000013EDAE40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4928-18-0x0000013EDAE30000-0x0000013EDAE40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4928-17-0x0000013EF3590000-0x0000013EF35B2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4928-7-0x0000013EDAE30000-0x0000013EDAE40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4928-6-0x0000013EDAE30000-0x0000013EDAE40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4928-5-0x00007FFCD34E0000-0x00007FFCD3FA1000-memory.dmp

      Filesize

      10.8MB

      Download